rule Backdoor_Win32_PcClient_DV{
	meta:
		description = "Backdoor:Win32/PcClient.DV,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 03 00 "
		
	strings :
		$a_03_0 = {68 fc fa ff ff 56 ff 15 90 01 04 8b 7c 24 90 01 01 8d 4c 24 90 01 01 6a 00 51 68 04 05 00 00 57 56 c7 44 24 20 00 00 00 00 ff 15 90 00 } //02 00 
		$a_03_1 = {76 17 8a 54 24 90 01 01 8b 4c 24 90 01 01 53 8a 1c 08 32 da 88 1c 08 40 3b c6 72 f3 90 00 } //02 00 
		$a_03_2 = {80 7d 00 53 0f 90 01 02 ff ff ff 80 7d 01 53 0f 90 01 02 ff ff ff 80 7d 02 48 0f 90 01 02 ff ff ff 90 00 } //01 00 
		$a_01_3 = {50 63 4d 61 69 6e 2e 64 6c 6c 00 } //01 00 
		$a_01_4 = {44 6f 4d 61 69 6e 57 6f 72 6b 00 } //01 00 
		$a_01_5 = {25 30 34 64 25 30 32 64 25 30 32 64 2f 25 30 32 64 25 30 32 64 25 30 32 64 2f 25 64 2e 6a 73 70 } //01 00  %04d%02d%02d/%02d%02d%02d/%d.jsp
		$a_03_6 = {70 61 73 73 90 02 07 6e 61 6d 65 90 02 07 70 6f 72 74 90 00 } //00 00 
	condition:
		any of ($a_*)
 
}