id: sfx1-malware-hash
info:
  name: Malicious SFX1 Hash - Detect
  author: pussycat0x
  severity: info
  description: SFX with voicemail content
  reference:
    - http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Minidionis.yar
  tags: malware,sfx1

file:
  extensions:
    - all

  matchers:
    type: dsl
    dsl:
      - "sha256(raw) == 'c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f'"
      - "sha256(raw) == '502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d'"
    condition: or