rule Exploit_WinNT_GetClass_A{
	meta:
		description = "Exploit:WinNT/GetClass.A,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
		
	strings :
		$a_01_0 = {19 04 32 19 03 32 2a b6 2d 2c b8 2a b6 2d 2c b8 a7 } //1
	condition:
		((#a_01_0  & 1)*1) >=1
 
}