Unspecified_Malware_Oct16_D

rule Unspecified_Malware_Oct16_D {
   meta:
      description = "Detects unspecified malware - October 2016"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      hash1 = "cd5f3bc0176a6803093ffdea6a7442c416e0d2945b6903063d17f5bb8d17519d"
      id = "6908467c-1ed6-508d-9503-246dd26823e5"
   strings:
      $s1 = "C:\\file.exe" fullword wide
      $s2 = "new.exe" fullword wide
      $s3 = "passwordIterations" fullword ascii

      $op0 = { 10 00 12 00 1a 00 05 00 01 00 01 00 01 00 10 00 } /* Opcode */
      $op1 = { 41 32 00 36 00 62 00 34 00 32 00 65 00 37 00 62 } /* Opcode */
      $op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 } /* Opcode */
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and ( all of ($s*) or all of ($op*) )
}