rule VirTool_WinNT_Cutwail_E{
	meta:
		description = "VirTool:WinNT/Cutwail.E,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 01 00 "
		
	strings :
		$a_01_0 = {e8 7d ff ff ff 0f b7 c0 83 f8 19 74 28 83 f8 50 74 23 3d e8 03 00 00 72 07 3d b8 0b 00 00 } //00 00 
	condition:
		any of ($a_*)
 
}