A Complete YARA Rule

rule Win32_Example_Downloader
{
    meta:
        author      = "CSC471"
        description = "Detects example downloader family"
        date        = "2026-02-01"
        reference   = "sha256: 3f2a...c19d"

    strings:
        $mz   = { 4D 5A }                       // PE magic "MZ"
        $s1   = "http://evil.example.com/payload" ascii wide
        $s2   = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
        $api  = "WriteProcessMemory" ascii fullword
        $hex  = { 6A 40 68 00 30 00 00 68 ?? ?? ?? ?? }

    condition:
        $mz at 0 and                            // is a PE
        filesize < 500KB and
        $api and
        2 of ($s1, $s2, $hex)
}