
rule m2319_14bb3ac1c8000932
{

   meta:
     copyright="Copyright (c) 2014-2018 Support Intelligence Inc, All Rights Reserved."
     engine="saphire/1.3.8 divinorum/0.9992 icewater/0.4"
     viz_url="http://icewater.io/en/cluster/query?h64=m2319.14bb3ac1c8000932"
     cluster="m2319.14bb3ac1c8000932"
     cluster_size="15"
     filetype = ""
     tlp = "amber"
     version = "icewater snowflake"
     author = "Rick Wesson (@wessorh) rick@support-intelligence.com"
     date = "20180910"
     license = "RIL-1.0 [Rick's Internet License]"
     family="fakejquery script trojandownloader"
     md5_hashes="['a1fccfe0d6fe93a47fcfd5ef715b1055a8ea396c','8a7ef661e35cc6b9e62cdfc3a3e72038e7d5bcd3','0a667350f40718138f4be2fe24d3ee6b7d1de0e6']"
     cluster_members="http://icewater.io/en/cluster/detail?h64=m2319.14bb3ac1c8000932"

   strings:
      $hex_string = { 746d702f696e7374616c6c5f346466653566333565633333362f64756d702e70687029205b3c6120687265663d2766756e6374696f6e2e696e636c756465273e }

   condition:
      
      filesize > 65536 and filesize < 262144
      and $hex_string
}
