YARA Detection Rule: _370c433dd61ec21d2677cfe02ef93a5f32a2b50d_5bf48d77bade79f2421ae3d258fe8262c043fb8f_08bdf374b28b234e[PII_REDACTED]06f4df79eac6ea_1
Repository: Yara-Rules/rules
Detects: Auto-generated rule - from files 370c433dd61ec21d2677cfe02ef93a5f32a2b50d.codex, 5bf48d77bade79f2421ae3d258fe8262c043fb8f.codex, 08bdf374b28b234e[PII_REDACTED]06f4df79eac6ea.codex
Author: YarGen Rule Generator
Reference: not set

Pattern signatures:
$s1 = ":$:+:2:9:@:G:N:U:\\:s:" fullword ascii
		$s2 = "6%6+606<6H6M6\\6b6g6v6}6" fullword ascii
		$s3 = "8\"8,818;8@8J8O8Y8^8h8m8w8" fullword ascii
		$s4 = "6 6'6.656<6C6J6Q6X6_6f6m6t6" fullword ascii
		$s5 = "4\"4)40474>4E4L4S4Z4a4h4" fullword ascii
		$s6 = "9\"9+91969?9E9J9S9\\9a9j9p9u9~9" fullword ascii
		$s7 = "9\"9'91999C9H9R9W9a9f9p9u9" fullword ascii
		$s8 = "4\"4(4-4<4B4G4S4_4d4s4y4~4" fullword ascii
		$s9 = "6\"6'6,6=6B6G6X6]6b6o6{6" fullword ascii
		$s10 = "?\"?/?4?B?G?L?Y?^?k?p?}?" fullword ascii
		$s11 = "3)31383>3C3L3R3W3c3i3n3w3}3" fullword ascii
		$s12 = ";&;+;5;:;D;I;S;X;b;j;t;y;" fullword ascii
		$s13 = "='=,=6=>=H=M=W=\\=a=m=r=w=" fullword ascii
		$s14 = ":!:*:/:9:>:H:P:Z:_:i:n:x:}:" fullword ascii
		$s15 = "3$3.383B3L3S3Z3a3h3o3v3}3" fullword ascii
		$s16 = "<$<.<3<=<B<L<Q<^<c<m<r<|<" fullword ascii
		$s17 = "31383?3F3M3T3[3b3i3p3w3~3" fullword ascii
		$s18 = "?*?1?8???F?M?T?[?b?i?p?w?" fullword ascii
		$s19 = "9!9(9/969=9D9K9R9Y9`9g9n9x9" fullword ascii
		$s20 = ":$

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 5 of ($s*) )and 1 of ($op*) ) or ( all of them )

Full rule:
rule _370c433dd61ec21d2677cfe02ef93a5f32a2b50d_5bf48d77bade79f2421ae3d258fe8262c043fb8f_08bdf374b28b234e[PII_REDACTED]06f4df79eac6ea_1 {
	meta:
		description = "Auto-generated rule - from files 370c433dd61ec21d2677cfe02ef93a5f32a2b50d.codex, 5bf48d77bade79f2421ae3d258fe8262c043fb8f.codex, 08bdf374b28b234e[PII_REDACTED]06f4df79eac6ea.codex"
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2016-07-21"
		super_rule = 1
		hash1 = "29b4498ac81d654b52cd0a32bdf29ed955f046ef9db1e0eba7da47ab2f950a3e"
		hash2 = "84ab50a9e325f64a54d84fb6798d8e74f46c21fd8b935d6c47a44bb140effad9"
		hash3 = "3f326fb6a79842c657efa09b71ce5e46dc110dd324bfabfcd32730d86de0bcf5"
	strings:
		$s1 = ":$:+:2:9:@:G:N:U:\\:s:" fullword ascii
		$s2 = "6%6+606<6H6M6\\6b6g6v6}6" fullword ascii
		$s3 = "8\"8,818;8@8J8O8Y8^8h8m8w8" fullword ascii
		$s4 = "6 6'6.656<6C6J6Q6X6_6f6m6t6" fullword ascii
		$s5 = "4\"4)40474>4E4L4S4Z4a4h4" fullword ascii
		$s6 = "9\"9+91969?9E9J9S9\\9a9j9p9u9~9" fullword ascii
		$s7 = "9\"9'91999C9H9R9W9a9f9p9u9" fullword ascii
		$s8 = "4\"4(4-4<4B4G4S4_4d4s4y4~4" fullword ascii
		$s9 = "6\"6'6,6=6B6G6X6]6b6o6{6" fullword ascii
		$s10 = "?\"?/?4?B?G?L?Y?^?k?p?}?" fullword ascii
		$s11 = "3)31383>3C3L3R3W3c3i3n3w3}3" fullword ascii
		$s12 = ";&;+;5;:;D;I;S;X;b;j;t;y;" fullword ascii
		$s13 = "='=,=6=>=H=M=W=\\=a=m=r=w=" fullword ascii
		$s14 = ":!:*:/:9:>:H:P:Z:_:i:n:x:}:" fullword ascii
		$s15 = "3$3.383B3L3S3Z3a3h3o3v3}3" fullword ascii
		$s16 = "<$<.<3<=<B<L<Q<^<c<m<r<|<" fullword ascii
		$s17 = "31383?3F3M3T3[3b3i3p3w3~3" fullword ascii
		$s18 = "?*?1?8???F?M?T?[?b?i?p?w?" fullword ascii
		$s19 = "9!9(9/969=9D9K9R9Y9`9g9n9x9" fullword ascii
		$s20 = ":$:*:/:8:>:C:L:U:Z:c:i:n:w:|:" fullword ascii

		$op0 = { fc014300c78424f0 } /* Opcode */
		$op1 = { a1d860440068d0cd430053ff90200300 } /* Opcode */
		$op2 = { c7819c0300000ca64000c[PII_REDACTED]0 } /* Opcode */
		$op3 = { 59395df8759d8d45fc505353538d45a8 } /* Opcode */
		$op4 = { 663bd875438bc62b450c8945fceb038b } /* Opcode */