text: 
  rule j3f9_05a6e1ed1ee31132
  {
  
     meta:
       copyright="Copyright (c) 2014-2018 Support Intelligence Inc, All Rights Reserved."
       engine="saphire/1.3.1 divinorum/0.998 icewater/0.4"
       viz_url="http://icewater.io/en/cluster/query?h64=j3f9.05a6e1ed1ee31132"
       cluster="j3f9.05a6e1ed1ee31132"
       cluster_size="4"
       filetype = "application/x-dosexec"
       tlp = "amber"
       version = "icewater snowflake"
       author = "Rick Wesson (@wessorh) rick@support-intelligence.com"
       date = "20171123"
       license = "RIL-1.0 [Rick's Internet License] "
       family="razy malicious malob"
       md5_hashes="['00da2ef7727c3209b2b9bc8df6cb1550','74c7d64762ab2283aa4d73780ea51ec6','7c9461cdf145dbfeea7f8fcbb325f14e']"
  
     strings:
        $hex_string = { b158045e09801868201523bf143c1251c4b048d2445e3101be9e24c0706c38404dec0e03bc6dfd03c422605cb40ea026619c680c40500058f07919d5064de4a1 }
  
     condition:
        
        filesize > 4096 and filesize < 16384
        and $hex_string
  }
  