id: sfx1-malware-hash
info:
  name: Malicious SFX1 Hash - Detect
  author: pussycat0x
  severity: info
  description: SFX with voicemail content
  reference:
    - http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Minidionis.yar
  tags: malware,sfx1

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == 'c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f'"
          - "sha256(raw) == '502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d'"
        condition: or
# digest: 4a0a0047304502204272d1926af9a4b43db2568f6d4c0bf65679cbc954a8e2b460218757bd396aca022100d8fa5e49e3e86ad3ed76354cf1429765f7a0dda2459a041030ddf85eb7093aa6:922c64590222798bb761d5b6d8e72950