text: 
  rule m2318_61b4b408d9bb0912
  {
  
     meta:
       copyright="Copyright (c) 2014-2018 Support Intelligence Inc, All Rights Reserved."
       engine="saphire/1.3.1 divinorum/0.998 icewater/0.4"
       viz_url="http://icewater.io/en/cluster/query?h64=m2318.61b4b408d9bb0912"
       cluster="m2318.61b4b408d9bb0912"
       cluster_size="87"
       filetype = "text/html"
       tlp = "amber"
       version = "icewater snowflake"
       author = "Rick Wesson (@wessorh) rick@support-intelligence.com"
       date = "20171118"
       license = "RIL-1.0 [Rick's Internet License] "
       family="ramnit html script"
       md5_hashes="['0d8fbeddab9615b757a0a0f6c7641336','11d51af847b16de446f4d4b53bca415c','3b4c2bafcaa17fa6b01266d913d7742d']"
  
     strings:
        $hex_string = { 687228434c6e6728222648222026204d6964285772697465446174612c692c322929290d0a4e6578740d0a46696c654f626a2e436c6f73650d0a456e64204966 }
  
     condition:
        
        filesize > 65536 and filesize < 262144
        and $hex_string
  }
  