rule VirTool_BAT_Obfuscator_BY{
meta:
description = "VirTool:BAT/Obfuscator.BY,SIGNATURE_TYPE_PEHSTR_EXT,64 00 01 00 01 00 00 "
strings :
$a_03_0 = {61 0c 06 16 07 6f ?? ?? ?? ?? 08 20 ff ff 00 00 5f } //1
condition:
((#a_03_0 & 1)*1) >=1
}