text: 
  rule m2319_14bb3ac1c8000932
  {
  
     meta:
       copyright="Copyright (c) 2014-2018 Support Intelligence Inc, All Rights Reserved."
       engine="saphire/1.3.8 divinorum/0.9992 icewater/0.4"
       viz_url="http://icewater.io/en/cluster/query?h64=m2319.14bb3ac1c8000932"
       cluster="m2319.14bb3ac1c8000932"
       cluster_size="15"
       filetype = ""
       tlp = "amber"
       version = "icewater snowflake"
       author = "Rick Wesson (@wessorh) rick@support-intelligence.com"
       date = "20180910"
       license = "RIL-1.0 [Rick's Internet License]"
       family="fakejquery script trojandownloader"
       md5_hashes="['a1fccfe0d6fe93a47fcfd5ef715b1055a8ea396c','8a7ef661e35cc6b9e62cdfc3a3e72038e7d5bcd3','0a667350f40718138f4be2fe24d3ee6b7d1de0e6']"
       cluster_members="http://icewater.io/en/cluster/detail?h64=m2319.14bb3ac1c8000932"
  
     strings:
        $hex_string = { 746d702f696e7374616c6c5f346466653566333565633333362f64756d702e70687029205b3c6120687265663d2766756e6374696f6e2e696e636c756465273e }
  
     condition:
        
        filesize > 65536 and filesize < 262144
        and $hex_string
  }
  