YARA Detection Rule: _84b76d765e7357fa5402b5af97d351424a8edf03_d0f90c1b3ebd79a816b5597a49ae8257df697591_da24c17f75cf0b7d6c5ab01832a827ee4b4c52eb_0
Repository: Yara-Rules/rules
Detects: Auto-generated rule - from files 84b76d765e7357fa5402b5af97d351424a8edf03.codex, d0f90c1b3ebd79a816b5597a49ae8257df697591.codex, da24c17f75cf0b7d6c5ab01832a827ee4b4c52eb.codex
Author: YarGen Rule Generator
Reference: not set

Pattern signatures:
$s1 = ":\":':,:5:=:B:K:P:U:^:c:h:q:v:{:" fullword ascii
		$s2 = "Y@.hdd \\" fullword ascii
		$s3 = "0$0+02090@0G0N0U0\\0c0j0v0{0" fullword ascii
		$s4 = "6\"6(6-6:6I6O6T6a6p6v6{6" fullword ascii
		$s5 = "1\"1/14191F1K1P1]1b1g1t1y1~1" fullword ascii
		$s6 = "0\"0(0-0<0B0G0S0_0d0s0y0~0" fullword ascii
		$s7 = "9\"9'959:9?9L9Q9^9c9p9y9~9" fullword ascii
		$s8 = "3%3*363=3B3N3T3Y3e3k3p3|3" fullword ascii
		$s9 = "4#4)4.4:4C4H4T4Z4_4k4q4v4" fullword ascii
		$s10 = "|&.WTm" fullword ascii
		$s11 = "6#63686E6J6W6\\6i6n6{6" fullword ascii
		$s12 = ";\";(;7;F;W;];f;o;{;" fullword ascii
		$s13 = "0+02080>0B0P0\\0i0|0" fullword ascii
		$s14 = "1 1(10181C1N1Y1d1o1z1" fullword ascii
		$s15 = "3 3%3*3;3@3E3R3^3c3t3y3" fullword ascii
		$s16 = "8\"8)8.8:8?8S8X8f8r8x8" fullword ascii
		$s17 = "8$8+82898@8G8N8U8\\8" fullword ascii
		$s18 = "9-929?9P9U9b9s9x9" fullword ascii
		$s19 = "9*9/9<9A9N9T9`9e9r9w9" fullword ascii
		$s20 = "2-292?2G2N2U2\\2c2j2q2" fullword ascii

		$op0 = { e0b34200c78424ac } /* 

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 5 of ($s*) )and 1 of ($op*) ) or ( all of them )

Full rule:
rule _84b76d765e7357fa5402b5af97d351424a8edf03_d0f90c1b3ebd79a816b5597a49ae8257df697591_da24c17f75cf0b7d6c5ab01832a827ee4b4c52eb_0 {
	meta:
		description = "Auto-generated rule - from files 84b76d765e7357fa5402b5af97d351424a8edf03.codex, d0f90c1b3ebd79a816b5597a49ae8257df697591.codex, da24c17f75cf0b7d6c5ab01832a827ee4b4c52eb.codex"
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2016-07-21"
		super_rule = 1
		hash1 = "add7ed26bc5bcacdf3159fcde71bdd429feeef94dff7d3b22bc9af9deb471c48"
		hash2 = "a9a62edbafa5932894ed53319c924932b94a0ccdf[PII_REDACTED]eed39fd46d86"
		hash3 = "efcc9e0377cf83a73bd5fbe42a51a2330936b8e362fc2ab99af6d932079893d9"
	strings:
		$s1 = ":\":':,:5:=:B:K:P:U:^:c:h:q:v:{:" fullword ascii
		$s2 = "Y@.hdd \\" fullword ascii
		$s3 = "0$0+02090@0G0N0U0\\0c0j0v0{0" fullword ascii
		$s4 = "6\"6(6-6:6I6O6T6a6p6v6{6" fullword ascii
		$s5 = "1\"1/14191F1K1P1]1b1g1t1y1~1" fullword ascii
		$s6 = "0\"0(0-0<0B0G0S0_0d0s0y0~0" fullword ascii
		$s7 = "9\"9'959:9?9L9Q9^9c9p9y9~9" fullword ascii
		$s8 = "3%3*363=3B3N3T3Y3e3k3p3|3" fullword ascii
		$s9 = "4#4)4.4:4C4H4T4Z4_4k4q4v4" fullword ascii
		$s10 = "|&.WTm" fullword ascii
		$s11 = "6#63686E6J6W6\\6i6n6{6" fullword ascii
		$s12 = ";\";(;7;F;W;];f;o;{;" fullword ascii
		$s13 = "0+02080>0B0P0\\0i0|0" fullword ascii
		$s14 = "1 1(10181C1N1Y1d1o1z1" fullword ascii
		$s15 = "3 3%3*3;3@3E3R3^3c3t3y3" fullword ascii
		$s16 = "8\"8)8.8:8?8S8X8f8r8x8" fullword ascii
		$s17 = "8$8+82898@8G8N8U8\\8" fullword ascii
		$s18 = "9-929?9P9U9b9s9x9" fullword ascii
		$s19 = "9*9/9<9A9N9T9`9e9r9w9" fullword ascii
		$s20 = "2-292?2G2N2U2\\2c2j2q2" fullword ascii

		$op0 = { e0b34200c78424ac } /* Opcode */
		$op1 = { 39750c598bd0598955fc7e4b0fb64c3e } /* Opcode */
		$op2 = { 3cee4200c784248c } /* Opcode */
		$op3 = { a1a[PII_REDACTED]c40430057ff90400100 } /* Opcode */
		$op4 = { 395814eb31a1a879440057ff75f456ff } /* Opcode */
		$op5 = { 663bd875438bc62b450c8945fceb038b } /* Opcode */
		$op6 = { f24200c784245c01000010f24