rule TrojanSpy_Win32_Guildma_A{
meta:
description = "TrojanSpy:Win32/Guildma.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_02_0 = {61 72 71 75 65 69 72 6f [0-02] 2e 64 6c 6c } //1
condition:
((#a_02_0 & 1)*1) >=1
}