id: sfx1-malware-hash
info:
  name: Malicious SFX1 Hash - Detect
  author: pussycat0x
  severity: info
  description: SFX with voicemail content
  reference:
    - http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950
    - https://github.com/Yara-Rules/rules/blob/master/malware/APT_Minidionis.yar
  tags: malware,sfx1

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == 'c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f'"
          - "sha256(raw) == '502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d'"
        condition: or
# digest: 4a0a0047304502200e2c3cc62b36d2691d31428dc78c90a5366600d2fa222a5349386454746d8336022100c85946745daae44f9d3a67811e66070af8dce77d3d8bc71e6b2654ee19bf5876:922c64590222798bb761d5b6d8e72950