-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathmiscreantpunch099.ldb
1204 lines (1204 loc) · 582 KB
/
miscreantpunch099.ldb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
MiscreantPunch.EXEInsideOfDoc.1;Target:0;(0);D0CF11E0A1B11AE1*004f0062006a0049006e0066006f00*4d5a{19-}21546869732070726f6772616d20
MiscreantPunch.EXEInsideOfDoc.2;Target:2;(0);D0CF11E0A1B11AE1*004f006c006500310030004e0061007400690076006500*4d5a{19-}21546869732070726f6772616d20
MiscreantPunch.JARInsideOfDoc.1;Target:0;(0);D0CF11E0A1B11AE1*004f006c006500310030004e0061007400690076006500*504b*4d4554412d494e462f4d414e49464553542e4d46*2e636c617373504b
MiscreantPunch.JARInsideOfDoc.2;Target:0;(0);D0CF11E0A1B11AE1*004f0062006a0049006e0066006f00*504b*4d4554412d494e462f4d414e49464553542e4d46*2e636c617373504b
MiscreantPunch.EXEInsideOfRTF.1;Target:0;(0);7b5c7274*34643561{38-}3534363836393733323037303732366636373732363136643230
MiscreantPunch.EXEInsideOfDoc.ASASCII.1;Target:2;(0);34643561{38-}3534363836393733323037303732366636373732363136643230
MiscreantPunch.EXEInsideOfDoc.VBASCII.1;Target:2;(0&1);26483444*26483541*26483638::wai;0/&H21[\s\r\n]*&H54[\s\r\n]*&H68[\s\r\n]*&H69[\s\r\n]*&H73[\s\r\n]*&H20[\s\r\n]*&H70[\s\r\n]*&H72[\s\r\n]*&H6F[\s\r\n]*&H67[\s\r\n]*&H72[\s\r\n]*&H61[\s\r\n]*&H6D[\s\r\n]*&H20[\s\r\n]*&H63[\s\r\n]*&H61[\s\r\n]*&H6E[\s\r\n]*&H6E[\s\r\n]*&H6F[\s\r\n]*&H74[\s\r\n]*&H20/si
MiscreantPunch.EXEInsideOfDoc.ASASCII.2;Target:0;(0);48344426616d703b48354126616d703b*48353426616d703b48363826616d703b48363926616d703b48373326616d703b48323026616d703b48373026616d703b48373226616d703b48366626616d703b48363726616d703b48373226616d703b48363126616d703b48366426616d703b::i
MiscreantPunch.EXEInsideOfDoc.B64.1;Target:2;((0|1|2)&(3|4|5|6|7|8));5456;3161;4e57;5647687063794251636d396e636d4674;526f61584d6755484a765a334a6862;5561476c7a49464279623264795957;53305653546b564d4d7a49755a477873;7446556b354654444d794c6d527362;4c52564a4f5255777a4d69356b6247
#MiscreantPunch.MacroDownloader.1;Target:2;(0&1&(2|3)&(4|5|6|7));55524c446f776e6c6f6164546f46696c65;5368656c6c45786563757465;0456424137;0456424136;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.HT.SWF;Target:11;(0);48545f6578706c6f6974
MiscreantPunch.SWF.EITestEvilRedir;Target:11;(0&1&2&3&4&5&6&7&8&9);a085d76204917563046204d1;03636361;026461;02656a;02676f;026872;026461;45787465726e616c496e74657266616365;66726f6d43686172436f6465;6164644576656e744c697374656e6572
MiscreantPunch.SWF.EITestEvilRedir.M2;Target:11;(0&1&2&3&4&5&6);6465636f6465546f427974654172726179;03636361;026461;02656a;02676f;026872;026461
MiscreantPunch.HT.SWF.ShellCode.STR;Target:11;(0|1|2);0a5368656c6c57696e3332;0a5368656c6c4d61633634;0a5368656c6c57696e3634
MiscreantPunch.SWF.Spartan.11122015;Target:11;(0);d1d1a085d5d32a??05??????????05d2??04????d12a??????????????06??0441010806aa4101290805c204??04d2????????????????d3????2400????d348
MiscreantPunch.SWF.MetasploitExploiter;Target:11;(0&1&2);646f5f726f705f::i;4578706c6f69746572::i;73707261795f6f626a65637473::i
#MiscreantPunch.PowerShellInsideOfDoc;Target:0;(0);D0CF11E0A1B11AE1*004f0062006a0049006e0066006f00*706f7765727368656c6c2e657865
MiscreantPunch.SWF.Nuclear.10152015;Target:11;(0&1);d030d1??01????????????2c??2c????????482c??2c??2c??2c??2c??????48;d12a??04d32403????d32400????a0d32401????a0d32402????a0??????04d22c??????????48
MiscreantPunch.SWF.Nuclear.10262015;Target:11;(0&1>15&2>15);d030d1d2aa48;d125????2f????????d1;d125????2d????????d1
MiscreantPunch.SWF.Nuclear.12012105;Target:11;(0&1&2&3);d12f??????????d12f??????????d12f??????????d12d??????????d12d??????????d12d;25e807a2;240aa2;d0d0????2c??a0????d02c??????d0d0
MiscreantPunch.SWF.Nuclear.02072016;Target:11;(0&1);a0742a6304240aa2*a0742a630425e807a2*a0742a630448;d030d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)*d030d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)*d030d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)????????01d1(2f|2d)
MiscreantPunch.SWF.Nuclear.02232016;Target:11;(0&1>1&2);a0742a6304240aa2;a0742a630425e807a2;2430a82404a6a0
MiscreantPunch.SWF.Nuclear.04052016;Target:11;(0&1&2&3);a074d6d225e807a2;a074d6d2240aa2;ff15??????00010000000000;2430a82404a6a0
MiscreantPunch.SWF.Nuclear.04152016;Target:11;(0&1&2);25ff01a8a025ff01a882;a074d6d2240aa2*a074d6d225e807a2*a074d6d225e807a2*a074d6d248;ff15????????010000000000
MiscreantPunch.SWF.Angler.11192015;Target:11;(0&1);(20|21)49496c49316c31314931316c494931494949;0e49496c31316c4949496c6c316c31
MiscreantPunch.SWF.Angler.10272015;Target:11;(0&1&2);62016203c748;6201620262036204a882????47;24012401c674
MiscreantPunch.SWF.Angler.11182015;Target:11;(0&1&(2|3));d030d1d2d3(62|63)04a8????47;2416240ba374;24592401c674;24599374
MiscreantPunch.SWF.Angler.11202015;Target:11;(0&1&2&3);2401a025ff01a8*25ff01a8{4-12}25ff01a8a025ff01a8;096c6f61644279746573;0a63686172436f64654174;080324ff48
#MiscreantPunch.SWF.Angler.12012015;Target:11;(0&1&2&3&4);ff15????0000??0000000000;a02c??a0;496c6c;6c4949;a025ff01a8
MiscreantPunch.SWF.Angler.12062015;Target:11;(0&1&2&3&4);24736f6d65537472696e677c736f6d654f74686572506172747c6f6e654d6f726550617274;496c;6c49;ff15????????010000000000;2401a025ff01a8
MiscreantPunch.SWF.Angler.02042016;Target:11;(0&1&2&3);24072401a0a6680d;2580082404a39374;ff15????????010000000000;d030d1d3a248
MiscreantPunch.SWF.Angler.03042016;Target:11;(0&1);d1d3????d2aa746304d1d3????74d6d1d36204????c203d3d1d0;ff15????????010000000000
MiscreantPunch.SWF.Angler.04042016;Target:11;(0&1&2&3&4);d030c20247;25ff01a8a025ff01a8;2401a025ff01a8;a425ff01a8????????????258002;ff15??????????0000000000
MiscreantPunch.SWF.Angler.04162016;Target:11;(0&1&2&3&4&5);6c6c49;6c6c31;2401a025ff01a8;2408a625ff01a8;2410a625ff01a8;d030??0247
MiscreantPunch.SWF.Angler.05092016;Target:11;(0&1&2&3&4);24002aa073;a025ff01a8;6c6c49;496c6c;316c49
MiscreantPunch.SWF.EvilRedir.07142016;Target:11;(0&1&2);5b4d6163726f57696e5d;5b4d616e756675636b5d;5b466c6173687665725d
MiscreantPunch.SWF.SunDownEK.05182016M2;Target:11;(0&1&2&3&4&5);036b6579;584f52;0a62696e61727944617461;6c6f61644279746573;63686172436f64654174;456d626564646564535746
MiscreantPunch.SWF.SunDownEK.05182016;Target:11;(0&1);0c58796b6a6564686773776477;ff15????????010000000000
MiscreantPunch.SWF.SunDownEK.07062016;Target:11;(0&1&2&3&4&5&6&7&8);03584f52;12766172707562626c696366756e6374696f6e;036b6579;0a62696e61727944617461;6c6f61644279746573;456d626564646564535746;63686172436f64654174;d0302863042f01d72f016304;ff15??????????0000000000
MiscreantPunch.SWF.Bizzaro.SunDown.EK.100716;Target:11;(0&1);4f5441354d446b774f5441354d446b774f5441354d446b774f*4d5449784d6a45794d5449784d6a45794d5449784d6a45794d5449784d;ff15??????????0000000000
MiscreantPunch.SunDownEKDec122016;Target:11;(0&1&2&3);086164644368696c64;096c6f61644279746573;0A63686172436f64654174;303930393039303930393039303930393039303930393039303930393039303930393039303930454237*323132313231323132313231323132313231323132313231323132313231323132
MiscreantPunch.SunDownEKJan102017;Target:11;(0);393039303930393045423731333343393634384237313330384237363043384237363143384235453038384237453230384233363636333934463138373546324333363038423643323432343842343533433842353432383738303344353842344131383842354132303033444445333334343938423334384230334635333346463333433046434143383443303734303743314346304430334638454246343342374332343238373545313842354132343033444436363842304334423842354131433033444438423034384230334335383934343234314336314333453839324646464646463544454230354538463346464646464638424644383145463043464646464646384246353831454537414646464646463831454437344646464646463638333343413841354235334538383446464646464635353641363446464430353738424638303346444134383037464646303037354639354636383845344530454543353345383637464646464646333343393636423936463645353136383735373236433644353446464430363833363141324637
MiscreantPunch.SunDownEKJan172017;Target:11;(0&1&2&3);656630316365303866626138356164::i;39303930393039303930393039303930393039303930393039303930::i;aa2446ab96;ff15??????????0000000000
MiscreantPunch.SWF.SunDown.EK.20170319;Target:11;(0&1&2&3&4&5&6&7&8&9);03726570;046c616365;03737562;03737472;a025ff01a8;035b2c5d;0167;ff15??????????0000000000;03427974;026573
MiscreantPunch.SWF.Huer.LBCAPNOPXLV;Target:11;(0&1&2&3&4);39303930393039303930393039303930393039303930;4361706162696c6974696573::i;6c6f61644279746573::i;ff15????????010000000000;a025ff01a8
MiscreantPunch.SWF.Suspicious.SecureSWF.Demo.04292016;Target:11;(0);50726f746563746564206279207365637572655357463c62722f3e44656d6f2076657273696f6e2e
MiscreantPunch.XAP.Angler.Encoder.02222016;Target:0;((0|1)&2&3);4d5a{19-}546869732070726f6772616d20*03044761d20a04031f??59d252062a;4d5a{19-}546869732070726f6772616d20*02034761D20A03021F1159D252062A;53696c7665724c69676874::i;417373656d626c79::i
#MiscreantPunch.SWF.Neutrino.12072015;Target:11;(0&1&2&3&4&5&6);ff15????????010000000000;ff15????????020000000000;ff15????????030000000000;ff15????????030000000000;036b6579;(03|04)627566;2401a025ff01a8
#MiscreantPunch.SWF.Neutrino.01112016;Target:11;(0&1&2&3&4&5&6&7);ff15????????010000000000;ff15????????020000000000;ff15????????030000000000;ff15????????030000000000;2400????2400????2400????2400????2400;2401a025ff01a8;bf14*016b;bf14*0162
MiscreantPunch.SWF.Neutrino.02172016;Target:11;(0>1&1&2>2);24??a124??a062??a024??a062??a062??a173;2401a062??a124??a0;ff15????0000??0000000000
MiscreantPunch.SWF.Neutrino.06142016;Target:11;(0&1&2&3&4);036b7970;03627274;03657170;6164646564546f5374616765;2400????2400????2400????2400????2400????2400
MiscreantPunch.SWF.Neutrino.06272016;Target:11;(0&1&2&3&4>2);036b7970;03627274;03657170;2400????2400????2400????2400????2400????2400;ff15????0000??0000000000
MiscreantPunch.SWF.Neutrino.09202016;Target:11;(0&1&2&3&4&5&6&7);63686172436f64654174::f;6c6f61644279746573::f;6c6f61644269746d61703332::f;2404a62403a848;a025ff01a874;759174????6206258002;25800215??ffff;ff15????????010000000000
MiscreantPunch.SWF.Exploit.HUER.K32VP;Target:11;(0&1);5669727475616c50726f74656374::i;4b65726e656c3332::i
MiscreantPunch.SWF.Exploit.CVE-2016-4117;Target:11;(0&1&2&3&4&5&6&7&8);44656c65746552616e676554696d656c696e654f7065726174696f6e;0176;03697274;0175;02616c;0170;02726f;0174;03656374
MiscreantPunch.SWF.WordJS.FlashRedir;Target:11;(0);433a5c55736572735c757365725c446f63756d656e74735c726564697265636b74325c7372633b3b::aw
MiscreantPunch.SWF.FlashPack.FROGH2BIN;Target:11;(0);46696e64526f7047616467657473::i
MiscreantPunch.SWF.EvilRedirector.08122016.M2;Target:11;(0&1&2&3&4&5&6&7&8);066465636f6465;03737472;036b6579;0372756e;096c6f61644279746573;0a63686172436f64654174;ff15??????00010000000000;2401a025ff01a874;0c6973546573744d6574686f64
MiscreantPunch.SWF.AstrumEK09232016;Target:11;(0&1&2&3&4&5&6&7&8&9&10&11&12&13);2447a1*a0241aa42441a073;2427a1*a0241aa42441a073;2401a025ff01a8;03726f74;027263;0a63686172436f64654174;09777269746542797465;0161;0162;ff15??????????0000000000;85a0a7;245cc62464c62412c5c1240ec52435c7c4;a025ff01*a025ff01;c7c525ff01
#MiscreantPunch.AstrumEK.112316;Target:11;(0&1&2&3&4&5&6&7&8);0A77726974654279746573::i;0C6164646564546f5374616765::i;0E77726974654d756c746942797465::i;086164644368696c64::i;06746172676574::i;066c6f61646572::i;096c6f61644279746573::i;0A63686172436f64654174::i;ff15??????????0000000000
#MiscreantPunch.SWF.Astrum.EK.11012016;Target:11;(0&1&2&3&4&5&6&7&8&9&10&11&12);027263::i;036b6579::i;05626c6f636b::i;0161::i;0162::i;0a77726974654279746573::i;0e77726974654d756c746942797465::i;096c6f61644279746573::i;1145787465726e616c496e74657266616365::i;08636f6d706c657465::i;a025ff01a8;2401a025ff01a8;ff15??????????0000000000
MiscreantPunch.SWF.Neutrinov.1101216;Target:11;(0&1&2&3&4&5&6&7&8&9&10&11);08746f42696e617279;0a63686172436f64654174;09427974654172726179;096c6f61644279746573;057374616765;086164644368696c64;056279746573;064c6f61646572;05636c6f6e65;a025ff01a874;2401a025ff01a8;ff15??????????0000000000
MiscreantPunch.SWF.AstrumEK.03172017;Engine:81-255,Target:11;(0&1&2&3&4&5);d162072ac06307{21}62086601d36206d362046601a025ff01620c12;62086601d36206d362046601a025ff01620c12;ff15??????????0000000000;0A77726974654279746573::i;0C6164646564546f5374616765::i;0E77726974654d756c746942797465::i
MiscreantPunch.SWF.AstrumEK.03202017;Engine:81-255,Target:11;(0>1&1&2&3);d030d140??2910??0000{4-50}d2aa4847;ff15??????????0000000000;28293b207d292829;45787465726e616c496e74657266616365
MiscreantPunch.SWF.Bizarro.SunDown.EK.11012016;Target:11;(0);5a3a5c74656d705f50726f5c4356343131372d323030365c7372633b
MiscreantPunch.SWF.Sofacy;Target:2;(0&1&2&3&4);465753*0a4d61696e36345f506179;064d61696e3634;ff15????0000??0000000000;2403a6aa;2407a5aa74
MiscreantPunch.SWF.Sofacy;Target:11;(0&1&2&3&4);465753*0a4d61696e36345f506179;064d61696e3634;ff15????0000??0000000000;2403a6aa;2407a5aa74
MiscreantPunch.SWF.RIG.EK.12232016;Target:11;(0&1&2);0A6765745f6269675f6261;0973707261795f6f626a;ff15????0000??0000000000
MiscreantPunch.SWF.RIG.EK.20170227;Target:11;(0&1&2);0973707261795f6f626a;0C736b69705f7061796c6f6164;ff15????0000??0000000000
MiscreantPunch.SWF.RIG.EK.20170303;Target:11;(0&1&2&3&4&5);d030240063042400d72e??d0d1{1-3}a073d7d2d33cd32e??a173d7d3376304d32404c673d7d337630447;d0302400d6240063042400d72e??d0d1{1-3}a073d7d3376304d32e??a173d7d337d6d32404c673d7d337d6620448;566563746f72;69734465627567676572;6c6f61646572496e666f;ff15????0000??0000000000
MiscreantPunch.SWF.RIG.EK.170829;Engine:81-255,Target:11;(0&1&2);69735f76756c6e::if;746573745f7370726179::if;72756e5f7368656c6c::if
MiscreantPunch.RTF.MWI;Target:0;(0&1);7b5c6669656c647b5c2a5c666c64696e7374207b20494e434c55444550494354555245*2e7068703f;5c5c2a204d45524745464f524d4154205c5c647d7d7b5c666c6472736c747d
MiscreantPunch.RTF.MWI;Target:0;(0&1);7b5c7274;7b5c6669656c647b5c2a5c666c64696e7374207b20494e434c55444550494354555245*69643d*5c5c2a204d45524745464f524d4154205c5c647d7d7b5c666c6472736c747d
MiscreantPunch.DOCX.Exploit.CVE-2015-1641;Target:0;(0);3c773a736d61727454616720773a7572693d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a6f66666963653a736d617274746167732220773a656c656d656e743d22262378424435303b262378374333383b223e
MiscreantPunch.DOCX.Exploit.CVE-2015-1641.M2;Target:0;((0|1)&2&3&4&5&6&7);0:D0CF11E0;0:7b5c7274;3c773a736d617274546167::i;773a656c656d656e743d::i;2623784244::i;773a646973706c616365644279437573746f6d586d6c3d::i;773a69643d22343239343936::i;1/w\:element=\s*[\x22\x27]\s*/i
MiscreantPunch.DOCX.Exploit.CVE-2015-1641.M3;Target:0;(0&1&2&3);3c212d2d207368656c6c636f6465202d2d3e::i;3c773a736d617274546167::i;773a646973706c616365644279437573746f6d586d6c3d227072657622::i;773a656c656d656e74::i
MiscreantPunch.RTF.Exploit.CommonConstruct;Target:0;(0);7b5c7274*7b5c6f626a64617461*393039303930393065(38|39)
MiscreantPunch.RTF.Exploit.CommonObfuscation;Target:0;(0&1>10&2&3=0&4);7b5c7274;7B5C7D5C5C5C2D5C2B5C255C5C5C5C5C2D5C;7D466F722070656E74657374696E6720707572706F736573206F6E6C7921;7b5c727466;5c6f626a64617461
MiscreantPunch.RTF.Exploit.CommonObfuscation.2;Target:0;(0&1>10);7b5c7274*466f722070656e74657374696e6720707572706f736573206f6e6c7921;5c2d5c2b5c25
MiscreantPunch.RTF.CommonObfuscation.CVE-2010-3333;Engine:81-255,Container:CL_TYPE_ANY,Target:0;(0&1>20&2&3&4&5=0);0:7b5c7274;7d7d7b7b;5c7376;5c736870;5c7376;7b5c727466
MiscreantPunch.RTF.CommonObfuscation.CVE-2010-3333.2;Engine:81-255,Container:CL_TYPE_ANY,Target:0;(0&1&2&3&4&5&6&7&8);0:7B5C7274*7B5C736E3120667D::i;7B5C736E3220727D::i;7B5C736E3320617D::i;7B5C736E3320617D::i;7B5C736E35206D7D::i;7B5C736E3620657D::i;7B5C736E37206E7D::i;7B5C736E3820747D::i;7B5C736E3920737D::i
MiscreantPunch.RTF.CommonObfuscation.3;Target:0;0;7B5C7274*6F626A64617461*5C62696E3720D0CF11E0A1B11A20*66666666666666666666666666666666
MiscreantPunch.MACRO.EvilAddy.M1;Target:2;(0&1);54686973446f63756d656e74;406578706c6f69742e696d
MiscreantPunch.MACRO.EvilAddy.M2;Target:2;(0&1&2);61766f69642043687224283029;55524c446f776e6c6f6164546f46696c65;54686973446f63756d656e74
MiscreantPunch.RTF.2012-0158.Common.Construct.1;Target:0;(0&(1|2)&(3|4));7b5c7274;34443533343336463644363337343643344336393632324534433639373337343536363936353737343337343732364332453332;34643533343336663664363337343663346336393632326534633639373337343536363936353737343337343732366332653332;35373646373236343245343436463633373536443635364537343245;35373666373236343265343436663633373536643635366537343265
MiscreantPunch.EvilMacro.CommonConstruct.1;Engine:81-255,FileSize:100-1000000,Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12);D0CF11E0A1B11AE1;436872;586f72;4372656174654f626a656374;4372656174655465787446696c65;52756e;5772697465;4175746f4f70656e;4175746f5f4f70656e;576f726b626f6f6b5f4f70656e;417363;4d6964;4f70656e
MiscreantPunch.EvilMacro.CommonConstruct.2;Target:0;((0&1&2&3&4&5&6&7)&8=0);D0CF11E0A1B11AE1*726573706f6e7365426f6479;786f72;4372656174655465787446696c65;52756e;4175746f4f70656e;73656e64;436872;4372656174654f626a656374;57696e4874747052657175657374
MiscreantPunch.EvilMacro.CommonConstruct.3;Target:0;(0&1&2&3);D0CF11E0A1B11AE1*47657443757272656e7450726f63657373;726573706f6e7365426f6479;4558454e616d65;43686172436f6465537472696e67
MiscreantPunch.EvilMacro.CommonConstruct.4;Target:0;(0&1&2&3&4&5&6&7&8);D0CF11E0A1B11AE1*456e7669726f6e6d656e74;57536372697074;726573706f6e7365426f6479;4f70656e;7368656c6c;41646f6462;436872;4372656174654f626a656374;006500
#MiscreantPunch.MacroHeurAOHDR.1;Target:2;(0&(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16)&(17|18|19|20|21|22|23)&(24|25|26|27|28|29|30|31|32|33));04564241(36|37);4175746f45786563;4175746f4f70656e;446f63756d656e745f4f70656e;446f63756d656e744f70656e;4175746f45786974;4175746f436c6f7365;446f63756d656e745f436c6f7365;446f63756d656e744265666f7265436c6f7365;446f63756d656e744368616e6765;4175746f4e6577;446f63756d656e745f4e6577;4e6577446f63756d656e74;4175746f5f4f70656e;576f726b626f6f6b5f4f70656e;4175746f5f436c6f7365;576f726b626f6f6b5f436c6f7365;55524c446f776e6c6f6164546f46696c6541;4d73786d6c322e584d4c48545450;4d6963726f736f66742e584d4c48545450;4d53584d4c322e536572766572584d4c48545450;557365722d4167656e74;4e65772d4f626a6563742053797374656d2e4e65742e576562436c69656e74;446f776e6c6f616446696c65;5368656c6c;76624e6f726d616c;76624e6f726d616c466f637573;766248696465;76624d696e696d697a6564466f637573;76624d6178696d697a6564466f637573;76624e6f726d616c4e6f466f637573;76624d696e696d697a65644e6f466f637573;575363726970742e5368656c6c;52756e
#MiscreantPunch.MacroHeurAOOBR.1;Target:0;(0&(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16)&(17|18|19|20|21)&(22|23|24|25|26|27|28|29|30|31)&((32|33|34|35|36)&37));D0CF11E0A1B11AE1;4175746f45786563;4175746f4f70656e;446f63756d656e745f4f70656e;446f63756d656e744f70656e;4175746f45786974;4175746f436c6f7365;446f63756d656e745f436c6f7365;446f63756d656e744265666f7265436c6f7365;446f63756d656e744368616e6765;4175746f4e6577;446f63756d656e745f4e6577;4e6577446f63756d656e74;4175746f5f4f70656e;576f726b626f6f6b5f4f70656e;4175746f5f436c6f7365;576f726b626f6f6b5f436c6f7365;436872;43687242;43687257;53747252657665727365;586f72;5368656c6c;76624e6f726d616c;76624e6f726d616c466f637573;766248696465;76624d696e696d697a6564466f637573;76624d6178696d697a6564466f637573;76624e6f726d616c4e6f466f637573;76624d696e696d697a65644e6f466f637573;575363726970742e5368656c6c;52756e;5772697465;507574;4f7574707574;5072696e742023;42696e617279;4f70656e
#MiscreantPunch.MacroHeurAOOBRFS.1;Target:2;(0&1&2&3&4&5&6&7&8);4d6963726f736f667420466f726d73;4d6963726f736f66742e584d4c48545450::i;41646f64622e53747265616d::i;5368656c6c2e4170706c69636174696f6e::i;726573706f6e7365426f6479::i;73617665746f66696c65::i;4372656174654f626a656374::i;2e657865::i;04564241
#MiscreantPunch.Jsocket.RAT.11162016.1;Target:12;(0|1|2|3);3ff9e3779b97f051;4005bf0a8b145769;b7e1(51|52)63;9e3779(b9|c9)
MiscreantPunch.Jsocket.RAT.11162016.2;Target:12;((0|1)&2&3&4&5);(03|04|05|06|07|08)(78|82)(03|04|05|06|07|08)(78|82)(03|04|05|06|07|08)5978(03|04|05|06|07|08)82(03|04|05|06|07|08)(03|04|05|06|07|08)82(03|04|05|06|07|08)78(03|04|05|06|07|08);(03|04|05|06|07|08)(78|82)(03|04|05|06|07|08)(78|82)(03|04|05|06|07|08)597882(03|04|05|06|07|08)(03|04|05|06|07|08)82(03|04|05|06|07|08)78(03|04|05|06|07|08);0006617070656e64;0006636861724174;0008746f537472696e67;00066c656e677468
MiscreantPunch.Jsocket.RAT.02082016.1;Target:12;((0|1)&2&3&4);1c5c3310db0459588291840201541c;1c5c3310dd8291548402011c;6465636f6465427566666572;4241534536344465636f646572;427974654172726179496e70757453747265616d
MiscreantPunch.Jsocket.RAT.11122015.1;Target:0;(0&1&2);504b*4d4554412d494e462f4d414e49464553542e4d46;6a6176612f7465787469746f2e;6d61696e2f53746172742e636c617373
MiscreantPunch.Jsocket.RAT.11122015.2;Target:0;(0&1&(2|3));504b*4d4554412d494e462f4d414e49464553542e4d46;0a0000004d61696e2e636c617373;05000000612e;05000000622e
MiscreantPunch.Jsocket.RAT.11122015.3;Target:0;(0&1&2&3);504b*4d4554412d494e462f4d414e49464553542e4d46;7265736f757263652f70617373776f72642e747874;7265736f757263652f7365727665722e646c6c;6d61696e2f53746172742e636c617373
MiscreantPunch.BanLoadJar.03042016.1;Target:12;(0&1&2&3&4);64656372797074::i;7061737461557372::i;4772617661646120636f6d207375636573736f20656d2042616e636f206465206461646f73::i;75726c::i;444553434f4d50414354::i
MiscreantPunch.Adwind.RAT.12022015.1;Target:12;(0&1&2&3&4);0c49445f52454d4f54455f5043;076f66664c696e65;066f6e4c696e65;706c7567696e732f;056765744964
MiscreantPunch.Adwind.RAT.010516;Target:12;(0&1&2&3);706c7567696e732f536572766572;066f6e4c696e65;076f66664c696e65;056765744964
MiscreantPunch.CVE-2012-0158.MIME.B64;Target:0;((0|1|2)&(3|4|5)&6);737872746332;6c3062786e6b;6a6467317a7a;71323969616d71616161;6e76796d706b61616161;6462326a717a61616161;75726e3a736368656d61732d6d6963726f736f66742d636f6d3a6f66666963653a6f6666696365
MiscreantPunch.RTF.EmbeddedDocCommonSpray;Target:0;((0>15)&1&2&3);37373666373236343266363136333734363937363635353832663631363337343639373636353538;7b5c7274;576f72642e446f63756d656e74;5c6f626a636c617373
MiscreantPunch.EvilMacro.AADODSCST.1;Target:0;(0&1&2&3&4&5);436872;5368656c6c;4170704163746976617465;446f63756d656e745f4f70656e;4461746553657269616c;54696d6572
MiscreantPunch.EvilMacro.AOUEGTP.1;Target:0;(0&1&2&3&4&5);4c6962;55524c446f776e6c6f6164546f46696c6541;2e657865;4175746f4f70656e;47657454656d705061746841;2e65786563
MiscreantPunch.EvilMacro.HAWEPRE.1;Target:2;(0&1&2&3&4&5&6);4d6963726f736f66742e584d4c48545450;41646f64622e53747265616d;575363726970742e5368656c6c;456e7669726f6e6d656e74;50726f63657373;726573706f6e7365426f6479;657865
MiscreantPunch.EvilMacro.Obfuscation.120715.1;Target:0;(0&1=0&2=0&3&4&5&6);D0CF11E0A1B11AE1*726573706f6e7365426f6479;4d6963726f736f66742e584d4c48545450;41646f64622e53747265616d;73617665746f66696c65;436872;4372656174654f626a656374;576f726b626f6f6b5f4f70656e
MiscreantPunch.EvilMacro.SMCHR.1;Target:2;(0&1>15&(2|3|4|5)&6);7368656c6c::i;2043687228::i;4175746f4f70656e::i;4175746f5f4f70656e::i;576f726b426f6f6b5f4f70656e::i;446f63756d656e745f4f70656e::i;1/& Chr\s*?\(\s*?(?P<p1>[\S\x29]+)\s*?[+*/^&-]\s*?(?P=p1)/i
MiscreantPunch.EvilMacroTXT;Target:0;(0|1|2|3);D0CF11E0A1B11AE1*496620796f7520646f776e6c6f61646564207468697320646f63756d656e742066726f6d20796f757220656d61696c2c20706c6561736520636c69636b20e2809c456e61626c652045646974696e67e2809d2066726f6d207468652079656c6c6f77206261722061626f76652e;3c773a646f63756d656e74*496620796f7520646f776e6c6f61646564207468697320646f63756d656e742066726f6d20796f757220656d61696c2c20706c6561736520636c69636b20e2809c456e61626c652045646974696e67e2809d2066726f6d207468652079656c6c6f77206261722061626f76652e;D0CF11E0A1B11AE1*496620796f7520646f776e6c6f61646564207468697320646f63756d656e742066726f6d20796f757220656d61696c2c20706c6561736520636c69636b2093456e61626c652045646974696e67942066726f6d207468652079656c6c6f77206261722061626f76652e;3c773a646f63756d656e74*496620796f7520646f776e6c6f61646564207468697320646f63756d656e742066726f6d20796f757220656d61696c2c20706c6561736520636c69636b2093456e61626c652045646974696e67942066726f6d207468652079656c6c6f77206261722061626f76652e
MiscreantPunch.EvilMacroTXT.2;Target:2;(0&1);417474656e74696f6e21205468697320646f63756d656e7420776173206372656174656420696e20746865206c61746573742076657273696f6e206f66204d6963726f736f6674204f666669636520544d;506c6561736520656e61626c65206d6163726f7320746f20636f72726563746c7920646973706c617920636f6e74656e74
#MiscreantPunch.EvilMacro.MixedCaseLibDecDecStr.1;Target:2;1;46756e6374696f6e::i;0/(?i)function(?-i)[\s]*?(?=[A-Z\d]*?[a-z])(?=[A-Z\d]*?[a-z])[A-Za-z0-9]+\s*?(?i)lib(?-i)\s*?\x22(?=[A-Z\d]*?[a-z])(?=[A-Z\d]*?[a-z])[A-Za-z0-9]+\x22\s*?(?i)alias(?-i)\s*?\x22(?=[0A-Z\d]*?[a-z])(?=[A-Z\d]*?[a-z])[A-Za-z0-9]+\x22\s*?\x28\s*?(?i)byval(?-i)\s+(?=[0A-Z\d]*?[a-z])(?=[A-Z\d]*?[a-z])[A-Za-z0-9]+\s+(?i)as(?-i)\s+(?i)string(?-i).+?(?:\d+\s*\,){10}/rs
#MiscreantPunch.Suspicious.ActiveMime.In.MHT.1;Target:0;(0&1&2&3);436f6e74656e742d4c6f636174696f6e3a2066696c653a2f2f2f;436f6e74656e742d5472616e736665722d456e636f64696e673a20626173653634;436f6e74656e742d547970653a206170706c69636174696f6e2f782d6d736f;51574e3061585a6c54576c745a514141
MiscreantPunch.RTF.CommonSprayConstructInEmbededDoc;Target:0;(0&1>2&2>1);7b5c7274;3631363337343639373636353538{1-8}3265363236393665;576f72642e446f63756d656e742e
MiscreantPunch.RTF.2016-4117.Exploit;Target:0;(0&1&2&3&4);7b5c7274;343336313730363136323639366336393734363936353733;366336663631363434323739373436353733;3339333033393330333933303339333033393330333933303339333033393330333933303339333033393330;61303235666630316138
MiscreantPunch.EvilMacro.SRAX.1;Target:2;(0&1);505454484c4d582e74666f736f7263694d;6d61657274532e42444f4441
MiscreantPunch.EvilMacro.SCWRSWMSE.1;Target:2;(0&1&2&3&4&5&6&7);5368656c6c;4372656174654f626a656374;53747252657665727365;2e53747265616d;72697465;4d6963726f736f66742e584d4c48545450;6573706f6e7365426f6479;657865
#MiscreantPunch.EvilMacro.AECXSR.1;Target:2;(0&1&2&3&4&5&6&7&8&9);5368656c6c;4372656174654f626a656374;436872;41444f4442;617665546f46696c65;456e7669726f6e;584d4c48545450;6573706f6e7365426f6479;72697465;2f6320
#MiscreantPunch.EvilMacro.AXSRFS.1;Target:2;(0&1&2&3&4&5&6&7&8);584d4c48545450;5368656c6c;46696c6553797374656d4f626a656374;4372656174655465787446696c65;53747252657665727365;2e53747265616d;50726f63657373;6573706f6e7365426f6479;4372656174654f626a656374
#MiscreantPunch.EvilMacro.AXSFRS.1;Target:0;(0&1&2&3&4&5&6&7);D0CF11E0A1B11AE1;584d4c48545450;575363726970742e5368656c6c;536372697074696e672e46696c6553797374656d4f626a656374;4d6963726f736f667420466f726d73;657865;41444f44422e53747265616d;52756e457865
#MiscreantPunch.EvilMacro.AXSFRS.2;Target:0;(0&1&2&3&4&5&6&7);D0CF11E0A1B11AE1;575363726970742e5368656c6c;584d4c48545450;456e7669726f6e6d656e74;50726f63657373;53747252657665727365;5368656c6c2e4170706c69636174696f6e;4372656174654f626a656374
MiscreantPunch.EvilMacro.CommunConstruct.5;Target:0;(0&1&2&3&4&5&6&7&(8|9|10|11|12)=0);D0CF11E0A1B11AE1;4372656174654f626a656374;617665546f46696c65;4d6963726f736f667420466f726d73;436872;5368656c6c;456e7669726f6e;6573706f6e7365426f6479;41444f4442;41646f6462;584d4c48545450;786d6c68747470;4f75746c6f6f6b2e4170706c69636174696f6e
MiscreantPunch.EvilMacro.AOXSFRSA;Target:2;(0&1&2>2&3&4&5&6&7&8);4d6963726f736f66742e584d4c48545450::i;5368656c6c2e4170706c69636174696f6e::i;4372656174654f626a656374::i;43616c6c42794e616d65::i;436872::i;53617665546f46696c65::i;5772697465::i;4f7574707574::i;5265706c616365::i
MiscreantPunch.EviMacro.SVDRBCO;Target:2;(0&1&2&3&4&5);4372656174654f626a656374::i;43616c6c42794e616d65::i;436872::i;5772697465::i;5265706c616365::i;4/[\x22\x21]r(?!esponsebody)(?P<e>[^\x22\x27])(?P<s>[^\x22\x27])p(?P<o>[^\x22\x27])n(?P=s)(?P=e)b(?P=o)dy[^\x22\x27]*?[\x22\x27]\s*,\s*?[\x22\x27](?:(?P=o)|(?P=e)|(?P=s))[\x22\x27]\s*?,\s*?[\x22\x27][seo][\x22\x27]/i
MiscreantPunch.EviMacro.SVDSTCO;Target:2;(0&1&2&3&4&5);4372656174654f626a656374::i;43616c6c42794e616d65::i;436872::i;5772697465::i;5265706c616365::i;4/[\x22\x21]s(?!avetofile)av(?P<e>[^\x22\x27])tofil(?P=e)[\x22\x27]\s*,\s*?[\x22\x27](?P=e)[\x22\x27]\s*?,\s*?[\x22\x27][e][\x22\x27]/i
MiscreantPunch.EviMacro.Split.XMLHTTP2;Target:2;(0&1&2);4372656174654f626a656374::i;5265706c616365::i;0/[\x22\x27]M(?!icrosoft\.xmlhttp)(?P<sepi>[^\x22\x27]{0,20})i(?P<sepc>[^\x22\x27]{0,20})c(?P<sepr>[^\x22\x27]{0,20})r(?P<sepo>[^\x22\x27]{0,20})o(?P<seps>[^\x22\x27]{0,20})s(?P<sepo2>[^\x22\x27]{0,20})o(?P<sepf>[^\x22\x27]{0,20})f(?P<sept>[^\x22\x27]{0,20})t(?P<sepdot>[^\x22\x27]{0,20})\.(?P<sepx>[^\x22\x27]{0,20})x(?P<sepm>[^\x22\x27]{0,20})m(?P<sepl>[^\x22\x27]{0,20})l(?P<seph>[^\x22\x27]{0,20})h(?P<sept2>[^\x22\x27]{0,20})t(?P<sept3>[^\x22\x27]{0,20})t(?P<sepp>[^\x22\x27]{0,20})p[^\x22\x27]*?[\x22\x27]\s*?,\s*?[\x22\x27](?=(?:((?P=sepi)|(?P=sepc)|(?P=sepr)|(?P=sepo)|(?P=seps)|(?P=sepo2)|(?P=sepf)|(?P=sept)|(?P=sepdot)|(?P=sepx)|(?P=sepm)|(?P=sepl)|(?P=seph)|(?P=sept2)|(?P=sept3)|(?P=sept3)|(?P=sepp)))[\x22\x27])[^\x22\x27]+[\x22\x27]/i
MiscreantPunch.EviMacro.Split.ADODB;Target:2;(0&1);5265706c616365::i;0/[\x22\x27]A(?!dobd\.stream)(?P<sepd>[^\x22\x27]{0,20})d(?P<sepo>[^\x22\x27]{0,20})o(?P<sepd2>[^\x22\x27]{0,20})d(?P<sepb>[^\x22\x27]{0,20})b(?P<sepdot>[^\x22\x27]{0,20})\.(?P<seps>[^\x22\x27]{0,20})s(?P<sept>[^\x22\x27]{0,20})t(?P<sepr>[^\x22\x27]{0,20})r(?P<sepe>[^\x22\x27]{0,20})e(?P<sepa>[^\x22\x27]{0,20})a(?P<sepm>[^\x22\x27]{0,20})m(?P<end>[^\x22\x27]{0,20})[\x22\x27]\s*,\s*[\x22\x27](?=(?:((?P=sepd)|(?P=sepo)|(?P=sepd2)|(?P=sepb)|(?P=sepdot)|(?P=seps)|(?P=sept)|(?P=sepr)|(?P=sepe)|(?P=sepa)|(?P=sepm)|(?P=end)))[\x22\x27])[^\x22\x27]+[\x22\x27]/i
#MiscreantPunch.EvilMacro.CommonConstruct.6;Target:0;(0&1&2&3);D0CF11E0A1B11AE1;777363726970742e7368656c6c::i;536f6674776172655c4d6963726f736f66745c57696e646f77735c43757272656e7456657273696f6e5c52756e::i;66696c6573797374656d6f626a656374::i
MiscreantPunch.EvilMacro.PowerShellExecBypass.1;Engine:81-255,Target:2;(0&1&2&3);706f7765727368656c6c::i;2d45786563::i;427950617373::i;417474726962757465205642
MiscreantPunch.EvilMacro.XMLSPLICE;Target:2;(0&1&2=0);224d::i;0/[\s\x22\x2b]*?S[\s\x22\x2b]*?X[\s\x22\x2b]*?M[\s\x22\x2b]*?L[\s\x22\x2b]*?[23][\s\x22\x2b]*?\.[\s\x22\x2b]*?X[\s\x22\x2b]*?M[\s\x22\x2b]*?L[\s\x22\x2b]*?H[\s\x22\x2b]*?T[\s\x22\x2b]*?T[\s\x22\x2b]*?P/ig;4d53584d4c322e584d4c48545450::i
MiscreantPunch.RTF.CommonExploitStruct;Target:0;(0&1&2);7b5c7274;4430434631314530::i;36633663353136383666366532653634363837353732366336643534::i
#MiscreantPunch.EvilMacro.CommonConstruct.7;Target:0;(0&1&2&3&4);D0CF11E0A1B11AE1;537472526576::i;726573706f6e7365426f6479::i;53617665546f46696c65::i;5368656c6c45786563757465::i
MiscreantPunch.EvilMacro.CommonConstruct.8;Target:0;(0&1&2&3&4&5);D0CF11E0A1B11AE1;52756e444c4c33322e455845::i;7368656c6c33322e646c6c::i;5368656c6c457865635f52756e444c4c::i;436d64;5245475f44574f5244::i
MiscreantPunch.BlackEnergy.EmbededEXEInMacro;Target:2;(0&1);4172726179::i;0/84\s*?,\s*?104\s*?,\s*?105\s*?,\s*?115\s*?,\s*?32\s*?,\s*?112\s*?,\s*?114\s*?,\s*?111\s*?,\s*?103\s*?,\s*?114\s*?,\s*?97\s*?,\s*?109/
MiscreantPunch.PYCTYPES.Inside.Macro;Target:2;(0&1&2&3&4&5&6);77696e646c6c;6b65726e656c3332;5669727475616c416c6c6f63;635f696e74;637479706573;696d706f7274;52746c4d6f76654d656d6f7279
MiscreantPunch.OleNativePackageDiagCab;Target:2;(0);006c006500310030004e00610074006900760065*6469616763616200*4d534346*446961675061636b6167652e63617400::iwa
MiscreantPunch.OleNativePackageEXECode.InsideOLE;Target:2;(0>1&1&2&3&4);005061636b616765;52746c4d6f76654d656d6f7279::i;5669727475616c416c6c6f63::i;437265617465546872656164::i;080000005061636b61676500
MiscreantPunch.OleNativePackageEXEExt.InsideOLE;Target:2;(0&1&2);006c006500310030004e00610074006900760065;000200;1/\x00\x02\x00[^\x00]+\x00(?:[a-z]\x3a\x5c|\x5c\x5c)[^\x00]*\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\x00\x00\x00\x03\x00.{4}(?:[a-z]\x3a\x5c|\x5c\x5c)[^\x00]*\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\x00/si
MiscreantPunch.JRAT.DisableCamLight.Plugin;Target:12;(0|1);53595354454d5c43757272656e74436f6e74726f6c5365745c436f6e74726f6c5c436c6173735c7b36424444314643362d383130462d313144302d424543372d3038303032424532303932467d::i;53595354454d5c43757272656e74436f6e74726f6c5365745c436f6e74726f6c5c436c6173735c7b34443336453937322d453332352d313143452d424643312d3038303032424531303331387d::i
MiscreantPunch.XAP.2016-0034;Target:1;(0&1&2&3&4&5&6&7);4765744368617273;4765744465636f646572;47657443686172436f756e74;457865635061796c6f6164;5368656c6c3332;5368656c6c3634;417373656d626c79;53797374656d2e54657874
MiscreantPunch.XAP.RIG.2016-0034;Target:1;(0&1&2&3&4&5&6);53696c7665724c69676874::i;4578706c6f6974::i;7368656c6c::i;7061796c6f6164::i;6865783262696e::i;6765745f61727261795f61646472657373::i;417373656d626c79::i
MiscreantPunch.XAP.Angler.04132016;Target:1;(0&1);6b726d6d4c314c4e687778;53696c7665726c696768742c56657273696f6e3d76342e30
MiscreantPunch.EvilMacro.ProcessCreationPrimitivesDLL;Target:2;(0&1&2&3&4&5&6&7&8);5669727475616c416c6c6f63::i;577269746550726f636573734d656d6f7279::i;43726561746550726f63657373::i;6b65726e656c3332::i;4c6962;416c696173::i;43726561746552656d6f7465546872656164::i;72756e646c6c3332::i;4c6f6e67507472::i
MiscreantPunch.EvilMacro.COBJRB.1;Target:2;(0&1&2);4372656174654f626a656374::i;7265706c616365::i;0/CreateObject\s*?\(\s*?Replace\s*?\(\s*?[\x22\x27][\x20-\x21\x23-\x26\x28-\x7e]+[\x22\x27]\s*?,\s*?[\x22\x27][\x20-\x21\x23-\x26\x28-\x7e]+[\x22\x27],\s*?[\x22\x27][\x22\x27]\s*?\)/i
#MiscreantPunch.PiratedOfficeVersionWMacrosXBAG.1;Target:2;(0&1&2&3);52655061636b206279204469616b6f76::iwa;0456424136;0456424137;56697375616c20426173696320466f72204170706c69636174696f6e::iwa
MiscreantPunch.MACRO.STRVGCOCBN;Target:2;(0&1&2);43616c6c42794e616d65::i;4372656174654f626a656374::i;5374725265766572736528225445472229::i
#MiscreantPunch.Macro.Suspicious.AOShellEXE;Target:2;((0|1)&2&3&4&5);4175746f4f70656e::i;4175746f5f4f70656e::i;5368656c6c::i;2e657865::i;56697375616c20426173696320466f72204170706c69636174696f6e73::iwa;4/\bShell\s*?\x28/i
MiscreantPunch.EvilMacro.RESPSTRCOCBN;Target:2;(0&1=0&2&3&4&5);726573706f6e7365626f6479::i;786d6c68747470::i;04564241;73747272657665727365::i;6372656174656f626a656374::i;63616c6c62796e616d65::i
MiscreantPunch.RTF.Common-2012-0158-Shellcode;Target:0;(0&1);7B5C7274::i;34616634356532373930393039303930393039303930393038336563346333336432623263303532356536363831636166663066383363323763353233336339::i
#MiscreantPunch.RTF.Likely-2012-1856-Common-Construct;Target:0;(0&1&2>1);7B5C7274::i;4D53436F6D63746C4C69622E546F6F6C6261722E32::i;4D53436F6D63746C4C69622E54616253747269702E32::i
MiscreantPunch.EvilMacro.AOUDTFEGSFCO;Target:2;((0|1)&2&3&4&5&6&7&8);4175746f4f70656e::i;4175746f5f4f70656e::i;55726c446f776e6c6f6164546f46696c65::i;75726c6d6f6e::i;04564241;2e657865::i;4765745370656369616c466f6c646572::i;4372656174654f626a656374::i;2/\(\s*ByVal\s*(?P<nibble>\w)\w+\s*As\s*Long\s*,\s*ByVal\s*(?P=nibble)\w+\s*As\s*String\s*,\s*?ByVal\s*(?P=nibble)\w+\s*As\s*String,\s*ByVal\s*(?P=nibble)\w+\s*As\s*Long\s*,\s*?ByVal\s*(?P=nibble)\w+\s*As\s*Long\s*?\)/i
MiscreantPunch.EvilMacro.FStore;Target:2;(0&1&2&3&4&5&(6|7|8));00456d626564646564204f626a656374;004d6963726f736f667420466f726d;4d6963726f736f66742e584d4c48545450::i;41646f64622e53747265616d::i;5368656c6c2e4170706c69636174696f6e::i;575363726970742e5368656c6c::i;6175746f6f70656e::i;6175746f5f6f70656e::i;446f63756d656e745f4f70656e::i
MiscreantPunch.EvilMacro.Bronie;Target:2;((0|1|2)&3&4&5&6&7);6175746f6f70656e;6175746f5f6f70656e::i;446f63756d656e745f4f70656e::i;53657457616c6c706170657242794f4c454f626a656374::i;436f7079496d616765::i;476574436c6970626f61726444617461::i;4f6c6543726561746550696374757265496e646972656374::i;04564241
MiscreantPunch.EvilMacro.FStore2;Target:2;((0|1|2|3)&4&5=0&6&7);6175746f6f70656e::i;6175746f5f6f70656e::i;446f63756d656e745f4f70656e::i;576f726b626f6f6b5f4f70656e::i;777363726970742e7368??6c6c::i;777363726970742e7368656c6c::i;00456d626564646564204f626a656374;004d6963726f736f667420466f726d
MiscreantPunch.EvilMacro.AORBXNCH;Target:2;(0&1=0&2&3&4&5&6&7&8&9&(10|11|12|13));726573706f6e7365626f6479::i;584d4c48545450::i;53747252657665727365::i;7772697465::i;6372656174656f626a656374::i;72756e::i;726573706f6e7365626f6479::i;73656e64::i;7772697465::i;73657452657175657374486561646572::i;576f726b626f6f6b5f6f70656e::i;446f63756d656e745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.MSFXSUDAES;Target:2;(0&1&2&3&4&5&6&7&8);4D53466F726D73;43616C6C42794E616D65::i;4372656174654F626A656374::i;04564241;4465636F64654172726179::i;456E636F6465537472696E67::i;586F72::i;75726C::i;53706C6974::i
MiscreantPunch.EvilMacroTXT.2;Target:0;(0&1&2);506c6561736520656e61626c65206d6163726f20666f722072656164::i;466f7220796f75722070726f74656374696f6e207468697320646f63756d656e7420686173206265656e20656e63727970746564::i;3c773a70696374::i
MiscreantPunch.EvilMacro.AOLARS;Target:2;(0>40&1>10&2&(3|4|5|6)&7);AC00????AC00????2B002A??????????AC;AC00????0B00AC00????0B00AC00????0C00AC00????0B00AC00;7368656c6c::i;4175746f5f4f70656e::i;6175746f6f70656e::i;446f63756d656e745f4f70656e::i;576f726b53686565745f4f70656e::i;5600420041005F00500052004F004A00450043005400
MiscreantPunch.CVE-2015-0097.Exploit.1;Target:2;(0&1&2&3&4);2e687461;41444f44422e5265636f7264736574;3c736372697074;4d53536372697074436f6e74726f6c2e536372697074436f6e74726f6c;5642536372697074
MiscreantPunch.CVE-2015-0097.Exploit.2;Target:2;(0&1);4d53536372697074436f6e74726f6c2e536372697074436f6e74726f6c;737664203d20225c75736572735c22202b2066202b2022
MiscreantPunch.EvilMacroShellcodePrimitives;Target:2;(0&1&2&3&4&5&(6|7|8|9)&10);52746c4d6f76654d656d6f7279::i;437265617465546872656164::i;5669727475616c416c6c6f63::i;4172726179::i;6b65726e656c3332::i;4c6962::i;6175746f70656e::i;6175746f5f6f70656e::i;776f726b626f6f6b5f6f70656e::i;646f63756d656e745f6f70656e::i;5600420041005F00500052004F004A00450043005400
MiscreantPunch.EvilPDpdEgg.1.NormHTML;Target:3;(0|1|2);55475251524f2f2b3671::i;426b554554762f757175::i;515a464245372f377172::i
MiscreantPunch.EvilPDpdEgg.1;Target:0;(0|1|2|3|4);55475251524f2f2b3671;426b554554762f757175;515a464245372f377172;50645044EFFEEAAE;35303634353034344546464545414145::i
MiscreantPunch.EvilMacroPowerShellDL.1;Target:0;(0&1&2&3&(4|5|6|7)&8);7368656c6c::i;2d457865637574696f6e506f6c696379::i;427970617373::i;4e65742e576562436c69656e74::i;6175746f5f6f70656e::i;6175746f6f70656e::i;646f63756d656e745f6f70656e::i;776f726b73686565745f6f70656e::i;5600420041005F00500052004F004A00450043005400
#MiscreantPunch.EvilMacro.S32STRRU;Target:2;(0&1&2&3&4&5&(6|7|8|9));53747252657665727365::i;436872::i;47657450726f6341646472657373::i;6b65726e656c3332::i;4c6f61644c696272617279::i;5600420041005F00500052004F004A00450043005400;6175746f5f6f70656e::i;6175746f6f70656e::i;646f63756d656e745f6f70656e::i;776f726b73686565745f6f70656e::i
MiscreantPunch.EvilMacro.AOPSH;Target:2;(0&1&2&3&4&5&(6|7|8|9));706f7765727368656c6c::i;2d6578::i;627970617373::i;2d77::i;68696464656e::i;5600420041005F00500052004F004A00450043005400;6175746f5f6f70656e::i;6175746f6f70656e::i;646f63756d656e745f6f70656e::i;776f726b73686565745f6f70656e::i
MiscreantPunch.RTF.CVE-2014-1761.Exploit.1;Target:0;(0&1&2&3);7b5c7274;5c6c6576656c73706163653232383733;5c6c6576656c696e64656e743233313330;5c6c6576656c737461727461743331363131
#MiscreantPunch.RTF.CVE-2014-1761.Exploit.2;Engine:81-255,Target:0;(0&1);7b5c7274*6c6973746f76657272696465636f756e74;0/listoverridecount0*(?:[4-7]|[8123]\d)/
MiscreantPunch.EvilMacro.XBagMacro.031416;Target:2;(0&1&2&3&(4|5|6|7));546f2041736328224d2229;546f2041736328225a2229;43616c6c42794e616d65::i;5265706c616365::i;446f63756d656e745f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.CVE-2012-0158.Exploit.CommonConstruct;Target:2;(0&1);436F626A64000000828200008282*90909090;52006F006F007400200045006E00740072007900
MiscreantPunch.RTF.CVE-2012-0158.Exploit.CommonConstruct;Target:0;(0&1&2);7b5c7274;34333646363236413634303030303030383238323030303038323832*3930393039303930::i;35323030364630303646303037343030323030303435303036453030373430303732303037393030::i
MiscreantPunch.EvilMacro.AOBATXS;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11));0:4174747269627574652056425f::i;5368656c6c::i;4372656174654f626a656374::i;436872::i;586f72::i;4372656174655465787446696c65::i;456e7669726f6e::i;2e626174::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.MAOACORLZ;Target:2;(0&1&2&3&4&5&6&7&8&9);4c656e;5265706c616365;4372656174654f626a656374;456e7669726f6e;43616c6c42794e616d65;436872;0/Len\s*\(\s*(?=[A-Z]*[a-z]+[A-Z]+[a-z])[A-Za-z]+\)\s*\/\s*0/i;1/Replace\s*\(\s*(?=[A-Z]*[a-z]+[A-Z]+[a-z])[A-Za-z]+,[^,]+,\s*?(?:\x22\x22|\x27\x27)\s*\)/i;2/CreateObject\s*\(\s*(?=[A-Z]*[a-z]+[A-Z]+[a-z])[A-Za-z]+\s*?\(\s*?(?=[A-Z]*[a-z]+[A-Z]+[a-z])[A-Za-z]+\s*\)\)/i;3/Environ\s*\(\s*(?=[A-Z]*[a-z]+[A-Z]+[a-z])[A-Za-z]+\)/i
MiscreantPunch.EvilMacro.AODBWSRBMS;Engine:81-255,FileSize:100-1500000,Target:2;(0&1&2&3&4&5&(6|7|8|9)&(10&11)=0);575363726970742e5368656c6c::i;41444f44422e53747265616d::i;53617665546f46696c65::i;726573706f6e7365626f6479::i;7772697465::i;73617665746f66696c65::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;76787261696c::i;706571::i
MiscreantPunch.EvilMacro.AOXOOLS;Target:2;(0&(1|2|3|4)&5&6&7&8&9);50726976617465204465636c6172652046756e6374696f6e;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;5368656c6c::i;4372656174654f626a656374::i;436872::i;586f72::i;0/Private Declare Function\s*?(?=[A-Z0-9]*[a-z]+[A-Z-0-9]+[a-z])[A-Za-z0-9]+\s+Lib\s+[\x22\x27](?=[A-Z0-9]*[a-z]+[A-Z-0-9])[A-Za-z0-9]+[\x22\x27]\s+Alias\s+[\x22\x27](?=[A-Z0-9]*[a-z])(?=[a-z0-9]*[A-Z])(?=[a-zA-Z]*[0-9])[A-Za-z0-9]+[\x22\x27]\s*\(\s*?ByVal\s*(?=[A-Z0-9]*[a-z]+[A-Z-0-9]+[a-z])[A-Za-z0-9]+\s+As\s+String\s*,\s*(?=[A-Z0-9]*[a-z]+[A-Z-0-9]+[a-z])[A-Za-z0-9]+\s+As\s+Long\s*\)\s*?As\s*?Long/
MiscreantPunch.EvilMacro.VBEFormHide;Target:2;(0&1&2&3&4&5&6&(7|8|9|10));23407e5e*5e237e40;4d6963726f736f667420466f726d73;456d626564646564204f626a656374;5368656c6c2e4170706c69636174696f6e::i;456e7669726f6e;4372656174654f626a656374::i;4372656174655465787446696c65::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacroTXT.3;Target:2;(0&1&2&3&4&5&6&7);4d6963726f736f6674::i;32303136::i;4572726f72::i;5468697320576f726420646f63756d656e742077617320736176656420696e2061206c617465722076657273696f6e206f66204d6963726f736f6674204f666669636520544d::i;546f206c6f61642074686520646f63756d656e74::i;706c6561736520456e61626c6520436f6e74656e74::i;54726164656d61726b73::i;48595045524c494e4b::i
MiscreantPunch.EvilMacro.PSHellAOSTR;Target:2;(0&1&2&3&4&5&(6|7|8|9));456e7669726f6e::i;53747252657665727365::i;5368656c6c::i;505368656c6c436f6465::i;53526576657273654d6f64::i;766248696465::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilDoc.OpenLure;Target:2;(0&1);5448495320444f43554d454e542049532053455420544f20424c555220464f5220594f555220534146455459::i;4b494e444c5920434c49434b204f5054494f4e2f454e41424c4520434f4e54454e542041424f564520544f205649455720444f43554d454e54::i
MiscreantPunch.EvilMacro.AOXAR;Target:2;(0&1>2&2&3&4&5&(6|7|8|9));283131363629203d20;28323729203d20;2f202832205e2028;5368656c6c::i;0/\(1166\)\s=\s+-?\d/;1/\(27\)\s=\s+-?\d/;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.EvilMacro.VB.FADAR;Target:2;(0&1&2&3&4&5=0&6=0&7=0&(8|9|10|11));726573706f6e7365626f6479::i;52756e::i;4372656174654f626a656374::i;2e657865::i;53617665546f46696c65::i;41444f44422e53747265616d::i;584d4c48545450::i;577363726970742e5368656c6c::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.D0COCBNDS;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13));5072697661746520436f6e737420::i;4c656e::i;417320496e7465676572::i;417320537472696e67::i;29202f2030::i;4372656174654f626a656374::i;43616c6c42794e616d65::i;456e7669726f6e::i;1/Len\s*\(\s*?(?=[a-z]*?[A-Z]+[a-z])[A-Za-z]+\s*\)\s+\/\s+0\s/s;0/(?:Private Const\s+(?=[a-z]*?[A-Z]+[a-z]+[A-Z])[A-Za-z]+\s+As\s+(?:String\s+=\s+\x22(?=[a-z]*?[A-Z]+[a-z]+[A-Z])[A-Za-z]+\x22\s+|Integer\s+=\s+\d+\s+)){2}/s;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.PShellVB.Dropper;Target:2;(0&1&2&3&4&(5|6|7|8));706f7765727368656c6c2e657865::i;636d642e657865::i;70696e67::i;766248696465::i;726567::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.DPSPAOXOR;Target:2;(0&1&(2|3|4|5));53706c697428646f632e4275696c74696e446f63756d656e7450726f70657274696573::i;7354656d70203d207354656d70202620436872284173632873436861722920586f7220696e744b657929::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.BadVB;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11));4f70656e::i;42696e617279::i;4372656174654f626a656374::i;456e7669726f6e::i;507574::i;4f7574707574::i;5072696e742023::i;0/Open\s+[\x22\x27][^\x22\x27]+[\x22\x27]\s+For\s+Binary\s+As\s+(?P<digi>\d+)\s+Put\s+#(?P=digi)\s*?,\s*?,\s*[A-Za-z]+\s+Close\s+#(?P=digi)/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.VB.DAIDW;Target:2;(0&1&2&3&4&5&6&(7|8|9|10));4f7574707574::i;5072696e742023::i;4f70656e::i;4372656174654f626a656374::i;456e7669726f6e::i;446f4576656e7473::i;0/[A-Za-z]+\s+=\s+(?P<nums>\d{2,4})\s+Do\s+While\s+[A-Za-z]+\s+\<\s+(?P=nums)\s+\+\s+\d+/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.Micro-Virus.M1;Target:2;(0&1&2&3&(4|5|6|7));4d6963726f2d5669727573::i;4d7367426f78::i;4f70656e::i;416374697665446f63756d656e742e536176654173::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.AOENCFUNC.1;Target:2;(0&1&2&3&4&5&6&(7|8|9|10));507269766174652046756e6374696f6e20::i;3d20417363284d696428::i;4d6f64::i;262043687228::i;456e7669726f6e::i;4372656174654f626a656374::i;0/Private\sFunction\s[A-Za-z]+\s*\(\s*?ByVal\s+(?P<string>[A-Za-z]+)\s+As\s+String\s*?,\s*?ByVal\s+(?P<int>[A-Za-z]+)\s+As\s+Integer.+?\s(?P<ASZ>[A-Za-z]+)\s*?=\s*?0\s.*?=\s*?Len\(\s*?(?P=string)\s*?\)\s*\/\s*(?P=ASZ)/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.AOK32IUOVAGT.1;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12));5669727475616c416c6c6f63::i;5368656c6c4578656375746541::i;496e7465726e65744f70656e55726c::i;496e7465726e65745265616446696c65::i;47657454656d7050617468::i;4c6962::i;416c696173::i;6b65726e656c3332::i;5600420041005F00500052004F004A004500430054;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.AnglerEK.XAP.CFortOb.033016;Target:1;(0&1&2);4672616D65776F726B446973706C61794E616D650D53696C7665726C696768742034;092121123122323123;0/FrameworkDisplayName\sSilverlight\s4.{4}(?=[a-z0-9]{0,19}[A-Z])(?=[A-Z0-9]{0,19}[a-z])(?=[a-zA-Z0-9]{0,17}(?:[a-z][A-Z]+[a-z0-9]|[a-z][0-9]+[a-zA-Z]))[A-Za-z0-9]{10,20}\x00/s
MiscreantPunch.EvilMacro.Thus;Target:2;(0&1&2&3&4&(5|6|7|8));41504d50::i;4b494c4c::i;536176654173::i;4f7074696f6e732e566972757350726f74656374696f6e::i;4170706c69636174696f6e2e446973706c6179537461747573426172::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.AOVPDSPDSX;Target:2;(0&1&2&3&4&(5|6|7|8));566972757350726f74656374696f6e::i;536176654e6f726d616c50726f6d7074::i;5368656c6c::i;2e657865::i;2/Shell\s*?\x28\s*[\x22\x27][^\x22\x27]+\.exe[\x22\x27]/;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.CVE-2015-5119.MSF.In.MSCOFF;Target:2;0;465753*BF14??????0001000000*5B2A5D204578706C6F69746572202D2073707261795F6F626A656374732829205B2A5D
MiscreantPunch.EvilMacro.OVPOS;Target:2;(0&1&2&3&4&(5|6|7|8));4f7074696f6e732e566972757350726f74656374696f6e::i;4f70656e::i;536176654173::i;456e61626c6543616e63656c4b6579::i;46696c654e616d65::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.WinAPIHeurDLEXE;Target:2;(0&1&2&3&4&(5|6|7|8));4c6962202277696e696e65742220416c6961732022496e7465726e65744f70656e::i;4c6962202277696e696e65742220416c6961732022496e7465726e65745265616446696c65::i;4c696220226b65726e656c33322220416c69617320225669727475616c416c6c6f6322::i;4c696220227368656c6c33322220416c69617320225368656c6c45786563757465::i;4c696220226b65726e656c33322220416c696173202247657454656d7050617468::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.AOLDZAM;Target:2;(0&1&2&3&(4|5|6|7));203d204c656e28;43616c6c42794e616d65::i;4372656174654f626a656374::i;0/= Len\(\s*?(?P<v1>[A-Za-z]+)\s*\)\s+\/\s+(?P<v2>[A-Za-z]+).+For\s+(?P=v2)\s*?=\s*?1\s+To\s+Len\(\s*(?P=v1)\s*\).+?=\s*Asc\s*\(\s*Mid\s*?\(\s*?(?P=v1)\s*,\s*(?P=v2)/s;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.CBNCO;Target:2;(0&1&2&3&4&5&(6|7|8|9));4372656174654f626a656374::i;43616c6c42794e616d65::i;436872::i;456e7669726f6e::i;4572722e4465736372697074696f6e::i;0/Private\s+Sub\s+[A-Za-z0-9]+\s?\(\s?ByVal\s+(?P<Var1>[A-Za-z0-9]+)\s+As\s+Variant\s?\)\s+CallByName\s+(?P=Var1)+\s?\x2c\s+[A-Za-z0-9]+\s?\(\s?\x22\s?[A-Za-z]+\s?\x22\s?\)\s?\x2c\s+\d/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.AOARS.1;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13));283130353329;2839383229;2836323629;28333629;5368656c6c::i;205e20;0/\s*?=\s*?\(?\s*?\-?\d/;1/\s*?=\s*?\(?\s*?\-?\d/;2/\s*?=\s*?\(?\s*?\-?\d/;3/\s*?=\s*?\(?\s*?\-?\d/;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.RTF.CommonExploitStruct.PW040716;Target:0;(0&1&2>1&3>1);7b5c7274;7b5c6f626a656374;7b5c706c6561736520776169742066696c65206973206c6f6164696e672a::i;576f72642e446f63756d656e74
MiscreantPunch.EvilMacro.AOSRRRSN.1;Target:2;(0&1&2&3&4&5);53706c6974285265706c616365285265706c616365285265706c61636528::i;4578654d6f64756c6541646472657373::i;4372656174654f626a656374::i;436872::i;3d2053706c697428::i;4/= Split\(\s*?[\x22\x27]\d{100}/s
MiscreantPunch.EvilMacro.RC3;Target:2;(0&1&2&3&4&5&6&(7|8|9|10));52756e::i;4372656174654f626a656374::i;43616c6c42794e616d65::i;436872::i;4572722e4465736372697074696f6e::i;2/CallByName\s*[A-Za-z]+?\s*,\s*(?P<func>[A-Za-z]+)\s*\(\s*(\x22|\x27)\s*[A-Za-z]+\s*(\x22|\x27)\s*\,\s*\d{1,2}\s*\)\s*.+?CallByName\s*[A-Za-z]+?\s*,\s*(?P=func)\s*\(\s*(\x22|\x27)\s*[A-Za-z]+\s*(\x22|\x27)\s*\,\s*\d{1,2}\s*\)/si;202f2030::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.RC3M2;Target:2;(0&1&2&3&4&5&6&(7|8|9|10));52756e::i;4372656174654f626a656374::i;43616c6c42794e616d65::i;436872::i;50726976617465::i;4170706c69636174696f6e2e52756e::i;5/Application\s*.\s*Run\s*[A-Za-z]+?\s*\(\s*\d{1,2}\s*,\s*[\x22\x27]\s*[A-Za-z]{40,}\s*[\x22|\x27]\s*\)/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.MEncoder1.04152016;Target:2;(0&1&2&3);5075626c69632046756e6374696f6e;202f20;202620;0/Public\sFunction\s+(?P<fname>[A-Za-z]+)\s*?\(\s*ByVal\s+(?P<v1>[A-Za-z]+)\s*?As\s*?(?P<type>[A-Z][a-z]+)\s*,\s*?ByVal\s+(?P<v2>[A-Za-z]+)\s+As\s+(?:Integer|Long)\s*?\)\s*?As\s*?(?P=type).+?(?P=fname)\s*=\s*(?P=v1).*?For\s+[A-Za-z]+\s*=\s*1\s*?To\s*?[A-Za-z].*?(?P=fname)\s*=\s*(?P=fname)\s*&\s*[A-Za-z][^\r\n]+(?P=v1)/si
MiscreantPunch.EvilMacro.BUKML.04152016;Target:2;(0&1);6D6163726F73206C6F6164696E67;0400750073006500720004004B006100740065
MiscreantPunch.EvilMacro.UKP.04182016;Target:2;(0&1);4e616d653d2250726f6a65637422;0400750073006500720004004B006100740065
MiscreantPunch.EvilMacro.CommonLure.04182016;Target:2;(0&1);54686520646f63756d656e74207761732065646974656420696e2061206e657765722076657273696f6e206f66204d53204f66666963652e::i;546f20636f72726563746c79206c6f61642074686520646f63756d656e742c20706c6561736520456e61626c6520436f6e74656e742e::i
MiscreantPunch.EvilMacro.VBESH.04192016;Target:2;(0&1&2&3&4&(5|6|7|8));5368656c6c;766248696465;2e766265;23407e5e;5e237e40;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.APT-ChrMZ;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14));46756e6374696f6e::i;0/Function\s+[A-Z0-9]+\s*?\(\s*?\)\s+As\s+String\s+.*?Chr\s*?\(\s*77\s*\)\s*?\+\s*?Chr\s*\(\s*90\s*\)/si;417320537472696e67::i;436872::i;53575f48494445::i;4f70656e::i;52756e::i;456e7669726f6e::i;4f7574707574::i;5c4e54555345522e646174::i;576f726b626f6f6b5f4f70656e::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.APT-OccultAgent;Target:2;(0&1&2&3&4&5&(6|7|8|9|10));5368656c6c::i;57536372697074;52756e::i;4372656174654f626a656374::i;4372656174655465787446696c65::i;687474703a2f2f3078::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.AOD0ARCR.042016;Target:2;(0&1&2&3&4&(5|6|7|8|9));2f2030;4372656174654f626a656374::i;52756e::i;28323629203d::i;283138333729203d::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.PSDLSCVH.04202016;Target:2;(0&1&2&3&4&5);706f7765727368656c6c::i;6e65742e776562636c69656e74::i;68747470;5368656c6c20636d64::i;20766248696465::i;4275696c74696e446f63756d656e7450726f706572746965732822436f6d6d656e747322292e56616c7565::i
MiscreantPunch.EvilMacro.ClassicPoppy.04202016;Target:2;(0&1&2);5669636f64696e4553;436c61737369632e506f707079;4c6f7264204e61746173
MiscreantPunch.EvilMacro.EXEdrop.;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11));52756e::i;4372656174654f626a656374::i;436872::i;586f72::i;2e657865::i;1/CreateObject\s*\x28Chr\$?\s*?[^\x29]*?\x29\s*?\+?\s*?Chr/i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.CVE-2012-1856.CommonConstruct.1;Target:2;(0&1&2&3&4&5&6&7&8);43726561746550726f6365737341;4c6f61644c69627261727941;55524c446f776e6c6f6164546f46696c6541;5461625374726970::i;2e657865::i;687474703a2f2f::i;4d53436f6d63746c4c6962::i;436f6d704f626a::iw;4f6666696365::i
#MiscreantPunch.EvilMacro.DropperWinHTTP;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15));4f70656e::i;5368656c6c::i;4372656174654f626a656374::i;41444f44422e53747265616d::i;53617665546f46696c65::i;456e7669726f6e::i;5772697465::i;57696e48545450::i;68747470::i;2e657865::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i
MiscreantPunch.CVE-2015-2545.AM;Target:0;(0&(1|2|3)&(4|5|6));75726e3a736368656d61732d6d6963726f736f66742d636f6d::i;4a535643623356755a476c755a304a7665::i;556c516d3931626d5270626d64436233::i;6c4a554a766457356b6157356e516d3934::i;4f5441354d446b774f54426c4f::i;6b774f5441354d446b775a54::i;354d446b774f5441354d4755::i
MiscreantPunch.EvilPDFOpenActionPowerShell;Target:10;(0&1&2&3);2f4f70656e416374696f6e::i;2f4c61756e6368::i;706f7765727368656c6c::i;0/\/OpenAction.*?\/Launch(?:(?!endobj).)+?powershell/si
MiscreantPunch.EvilMacro.CBNE0;Target:2;(0&1&2&3);43616c6c42794e616d65::i;46756e6374696f6e::i;4170706c69636174696f6e2e52756e::i;1/Function\s*?(?P<var>[A-Za-z0-9]+)\s*\(\s*\)\s*As\s+(Integer|Long)\s+(?P=var)\s*=\s*0\s+End\s+Function/si
MiscreantPunch.EvilDoc.GenLure1;Target:2;(0&1&2&3);5468697320646f63756d656e7420776173207361766564::i;76657273696f6e206f66204d6963726f736f667420576f72642e::i;546f20726561642074686520646f63756d656e742c20706c65617365::i;2/E\s*?n\s*?\s*?a\s*?b\s*?l\s*?e\s+?C\s*?o\s*?n\s*?t\s*?e\s*?n\s*?t\s*?\./i
MiscreantPunch.RTF.CVE-2010-3333;Target:0;(0&1&2&(3|4));7b5c7274;5c7376::i;1/\x5csv[\x7b\x7d\x5c\x2a\s0]*(?![248][\x7b\x7d\x5c\x2a\s]*\x3b)\d+[\x7b\x7d\x5c\x2a\s]*\x3b/si;70465261674D456E5453::i;70465261674D456E5453
MiscreantPunch.MFAWSCAOSS.04272016;Target:2;(0&1&2&3&(4|5));4D6963726F736F667420466F726D7320322E3020;6963726F::i;41646F64622E::i;5600420041005F00500052004F004A00450043005400;0/icro(?P<s>[^s]{1,20})oft.*?(?:Adodb\.(?P=s)|W(?P=s)cript\.(?P=s))/si;0/Adodb\.(?P<s>[^s]{1,20}).*?(?:icro(?P=s)oft|W(?P=s)cript\.(?P=s))/si
MiscreantPunch.PDF.PossiblePowerShellDownloader;Target:10;(0|1|2)&(3|4|5)&(6|7|8);52473933626d7876595752476157786c;5276643235736232466b526d6c735a;4562336475624739685a455a706247;55335268636e517455484a765932567a63;4e3059584a304c56427962324e6c6333;546447467964433151636d396a5a584e7a;55336c7a644756744c6b356c644335585a574a4462476c6c626e;4e356333526c6253354f5a58517556325669513278705a573530;5465584e305a573075546d56304c6c646c596b4e736157567564
MiscreantPunch.EvilMacro.AOD0AR.04282016;Target:2;(0&1&2>1&3&(4|5|6|7));202f2030;283138333429203d20;28323229203d20;2835363329203d20;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.EvilMacro.AOPOWRWMI.04282016;Target:2;(0&1&2&3&(4|5|6|7));57696e33325f50726f63657373::i;706f7765727368656c6c::i;5c726f6f745c63696d7632::i;417474726962757465205642::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.Macro.PossiblePowerShellDownloader;Target:2;(0|1|2)&(3|4|5)&(6|7|8);52473933626d7876595752476157786c;5276643235736232466b526d6c735a;4562336475624739685a455a706247;55335268636e517455484a765932567a63;4e3059584a304c56427962324e6c6333;546447467964433151636d396a5a584e7a;55336c7a644756744c6b356c644335585a574a4462476c6c626e;4e356333526c6253354f5a58517556325669513278705a573530;5465584e305a573075546d56304c6c646c596b4e736157567564
MiscreantPunch.EvilMacro.AOPOWRWMI.04282016;Target:2;(0&1&2&(3|4|5|6));706f7765727368656c6c*2d43::i;4174747269627574652056425f::i;2e537061776e496e7374616e6365::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilDoc.GenLure1;Target:2;(0&1&2&3);5468697320646f63756d656e742077617320736176656420::i;0/l\s*?a\s*?t\s*?e\s*?r\s+?v\s*?e\s*?r\s*?s\s*?i\s*?o\s*?n\s+?o\s*?f\s+?M\s*?i\s*?c\s*?r\s*?o\s*?s\s*?o\s*?f\s*?t\s+?W\s*?o\s*?r\s*?d\s*?./i;546f20726561642074686520646f63756d656e742c20706c65617365::i;2/E\s+?n\s+?a\s+?b\s+?l\s+?e\s+?C\s+?o\s+?n\s+?t\s+?e\s+?n\s+?t\s+?\./i
MiscreantPunch.EvilMacro.FDODV.04292016;Target:2;(0&1);5075626c6963::i;0/Function\s+?(?P<var1>[A-Za-z0-9]+)\s*\(\s*\)\s*As\s+?(?:Integer|Long)\s+(?P=var1)\s*=\s*0\s+End\s+Function.*Function\s+(?P<var2>[A-Za-z0-9]+)\s*\(\s*\)\s*As\s+(?:Integer|Long)\s+(?P=var2)\s*=\s*\d{1,5}\s*\/\s*(?P=var1)\s+End\s+Function/s
MiscreantPunch.EvilMacro.WinHTTPDownloader.Gen1;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15));254150504441544125;2e746d70::i;416374697665446f63756d656e74::i;4f70656e::i;436c6f7365::i;43616c6c57696e646f7750726f6341::i;47657450726f6341646472657373::i;68747470::i;657865::i;4b696c6c::i;53617665::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilDoc.DivBy0;Target:2;(0&1);46756e6374696f6e::i;0/Function\s+?(?P<var1>[A-Za-z0-9]+)\s*\(\s*\)\s*As\s+?(Integer|Long)\s+(?P=var1)\s*=\s*\d{1,5}\s*\/\s*(?P<var2>[A-Za-z0-9]+)\s+End\s+Function\s+(Private|Public)\s+Function\s+(?P=var2)\s*\(\s*\)\s*As\s+(Integer|Long)\s+(?P=var2)\s*=\s*0\s+End\s+Function/si
MiscreantPunch.EvilDoc.DivBy0.M2;Target:2;(0&1);46756e6374696f6e::i;0/Function\s+?(?P<var1>[A-Za-z0-9]+)\s*\(\s*\)\s*As\s+?(Integer|Long)\s+(?P=var1)\s*=\s*(?P<var2>[A-Za-z0-9]+)\s+End\s+Function.+(Private|Public)\s+Function\s+(?P<var3>[A-Za-z0-9]+)\s*\(\s*\)\s*As\s+(Integer|Long)\s+(?P=var3)\s*=\s*[A-Za-z0-9]+\s*\/\s*(?P=var1)\s+End\s+Function.+(Private|Public)\s+Function\s+(?P=var2)\s*\(\s*\)\s*As\s+(Integer|Long)\s+(?P=var2)\s*=\s*0\s+End\s+Function/si
MiscreantPunch.EvilMacro.AOCPS1SSC.05092016;Target:2;(0&1&2&3&4&(5|6|7|8|9));636d64202f4b::i;2e657865::i;2e707331::i;5368656c6c::i;202b20;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.STRRCOWS.05102016;Target:2;(0&1);4372656174654f626a656374285374725265766572736528::i;4372656174654f626a6563742822575363726970742e5368656c6c2229::i
#MiscreantPunch.EvilMacro.OACOW;Target:2;(0&1&2&3&4&5&6&7&8);417474726962757465205642::i;44696d::i;4f626a656374::i;41444f44422e53747265616d::i;4372656174654f626a656374::i;57536372697074::i;5368656c6c::i;4d53584d4c32::i;536572766572584d4c48545450::i
#MiscreantPunch.EvilMacro.B64RASE;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12));44696d::i;5368656c6c::i;4372656174654f626a656374::i;4372656174655465787446696c65::i;456e7669726f6e::i;4261736536344465636f6465::i;46696c6553797374656d4f626a656374::i;2e657865::i;54454d50::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.StartupXLS;Target:2;(0&1&(2|3|4|5|6));537461727455702e786c7321657363617065::i;416374697665576f726b626f6f6b2e53617665417320284170706c69636174696f6e2e5374617274757050617468202620225c2220262022537461727455702e786c732229::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.AOSHEBE.05172016;Target:2;(0&1&2&3&4&5&(6|7|8|9|10));5368656c6c::i;766248696465::i;42696e617279::i;456e7669726f6e::i;2e657865::i;0/Shell\s*\(\s*[A-Z0-9a-z_-]+\s*,\s*vbHide\s*\)/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.PSB64Drop;Target:2;(0&1&2&3&4&5&(6|7|8|9));5368656c6c::i;706f7765727368656c::i;2d77696e646f772068696464656e::i;2d656e63::i;3/enc\x20[A-Za-z0-9]+\s*(\x22|\x27)\s*_\s+&\s*((\x22|27)[A-Za-z0-9]+\s*\x22\s*_\s+&\s*){5,}\s*(\x22|\x27)[A-Za-z0-9]+\s*(\x22|\x27)/si;4d7367426f78::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.EvilMacro.SERFSFI.06012016;Target:2;(0&1&2&3&4);507269766174652046756e6374696f6e::i;4572726f72::i;0/Private Function\s+(?P<ifunc>[a-zA-Z]+)\s*\x28[^\x29]*\x29\s+As\s+Integer(?:(?!End\s+Function).)+(?P=ifunc)\s*=\s*\d+\s/si;0/Private Function\s+(?P<sfunc>[a-zA-Z]+)\s*\x28[^\x29]*\x29\s+As\s+String(?:(?!End\s+Function).)+(?P=sfunc)\s*=[^\x27\x22\r\n][\x22\x27][A-Za-z\d]+[\x22\x27]/si;1/Error\s+\d/s
#MiscreantPunch.EvilMacro.SERFSFI.06012016.M2;Target:2;(0&1&2);507269766174652046756e6374696f6e::i;0/Private Function\s+(?P<ifunc>[a-zA-Z]+)\s*\x28[^\x29\r\n]*\x29\s+As\s+Integer(?:(?!End\s+Function).)+(?P=ifunc)\s*=\s*\d+\s/si;0/Private Function\s+(?P<sfunc>[a-zA-Z]+)\s*\x28[^\x29\r\n]*\x29\s+As\s+String(?:(?!End\s+Function).)+(?P=sfunc)\s*=[^\x27\x22\r\n]*[\x22\x27][A-Za-z\d]+[\x22\x27].+?Private Function\s+(?P<sfunc2>(?!(?P=sfunc))[a-zA-Z]+)\s*\x28[^\x29\r\n]*\x29\s+As\s+String(?:(?!End\s+Function).)+?(?P=sfunc2)\s*=[^\x27\x22\r\n]*[\x22\x27][A-Za-z\d]+[\x22\x27].+?Private Function\s+(?P<sfunc3>(?!(?P=sfunc))(?!(?P=sfunc2))[a-zA-Z]+)\s*\x28[^\x29\r\n]*\x29\s+As\s+String(?:(?!End\s+Function).)+(?P=sfunc3)\s*=[^\x27\x22\r\n]*[\x22\x27][A-Za-z\d]+[\x22\x27]/si
#MiscreantPunch.EvilMacro.SERFSFI.06012016.M3;Target:2;(0&1&2&3&4);507269766174652046756e6374696f6e::i;4572726f72::i;0/Private Function\s+(?P<ifunc>[a-zA-Z]+)\s*\x28[^\x29]*\x29\s+As\s+Integer(?:(?!End\s+Function).)+(?P=ifunc)\s*=\s*\d+\s/si;0/Private Function\s+(?P<sfunc>[a-zA-Z]+)\s*\x28[^\x29]*\x29\s+As\s+String(?:(?!End\s+Function).)+(?P=sfunc)\s*=\s*[A-Za-z\d]+\.[A-Za-z\d]+\s*\(\s*[A-Za-z\d]/si;1/Error\s+\d/s
MiscreantPunch.XOCISCACMLAR.06072016;Target:2;(0&1&2&3&4);2b2043687228417363284d696428::i;586f722043496e7428::i;5368656c6c28::i;417272617928::i;3/Array\([\s\x2c\r\n\d_]{500}/i
MiscreantPunch.AOK32RTLMMCT.06072016;Target:2;(0&1&2&3&4&5&(6|7|8|9|10));437265617465546872656164::i;5669727475616c416c6c6f63::i;52746c4d6f76654d656d6f7279::i;6b65726e656c3332::i;417272617928::i;4/Array\([\s\x2c\r\n\d_]{500}/i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.SHXOEBBASCAO.06092016;Target:2;(0&1&2&3&4>10&5&6&7&(8|9|10|11|12));5368656c6c::i;766248696465::i;586f72::i;456e7669726f6e::i;417320426f6f6c65616e::i;3d20417363282241222920546f2041736328225a22293a;3d20417363282261222920546f2041736328227a22293a;0/Shell[^\r\n]+vbHide/i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.DD0XARAO;Target:2;(0&(1|2)>10&3&4>2&5&6&(7|8|9|10|11));202f2030;29203d202d;29203d20282d;205e20;28323329203d;4465627567::i;5/Debug[^\r\n]+\s\/0\s/i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.DADbZ;Target:2;(0&1&2&3&4&5&6&(7|8|9|10));52756e::i;4372656174654f626a656374::i;44696d::i;4465627567::i;417373657274::i;2/((?P<var1>[A-Za-z0-9]{3,7})\s*\(\s*\d{1,3}\s*\)\s*=\s*\d{1,3}\s+(?P=var1)\s*\(\s*\d{1,3}\s*\)\s*=\s*\d{1,3}\s+)+/si;3/Debug\s*\.\s*Assert\s*[0-9]{4,6}\s*\/\s*0/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.EvilMacro.XOSVBHAO;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11));5368656c6c::i;766248696465::i;6b65726e656c3332::i;52746c4d6f76654d656d6f7279::i;456e7669726f6e::i;20586f7220::i;0/Shell\b[^\r\n]*?\bvbHide/;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.XOAMCSTRAOSW;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11));726573706f6e7365426f6479::i;586f7220434279746528417363284d6964::i;41707044617461::i;53747252657665727365::i;4174747269627574652056425f::i;53686f7757696e646f77::i;437265617465::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.AR4SHUF;Target:2;(0>3&1&2&3&4&5&6&7&8&9&10&11&(12|13|14|15|16));283429203d20;7368656c6c20::i;202f20;202a20;202b20;202d20;4174747269627574652056425f::i;55736572466f726d::i;0/\(4\)\s*=\s*[\x28\s]*\-?\d+/;2/\x20\x2f\x20\d{2,20}/;3/\x20\x2b\x20\d{2,20}/;4/\x20\x2d\x20\d{2,20}/;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.SVBCXESC;Target:2;(0&1&2&3&4&5&6&7);68657832737472::i;64656372797074637573746f6d::i;656e7669726f6e::i;636872::i;7368656c6c::i;766268696465::i;44654372797074437573746f6d::i;4372797074537472696e67::i
#MiscreantPunch.EvilMacro.URLDropper.1;Target:2;(0&1&2&3&4&(5|6|7|8));55524c446f776e6c6f6164546f46696c6541::i;4c6962::i;456e7669726f6e::i;5368656c6c::i;50726976617465::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.WAPIREVS;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14));50726976617465::i;7573657233322e646c6c::i;6b65726e656c33322e646c6c::i;416374697665446f63756d656e74::i;4b696c6c::i;42696e617279::i;4f70656e::i;507574::i;53747252657665727365::i;537472507472::i;456e7669726f6e::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.EvilMacro.SCBRWSRCO;Target:2;(0&1&2&3&4&5&6&7&8&9&10);417474726962757465205642::i;537472436f6e76::i;42696e617279::i;52656164::i;5772697465::i;53747252657665727365::i;4372656174654f626a656374::i;57536372697074::i;5368656c6c::i;43617365::i;9/\s*(?P<var1>[0-9]{1,3})\s*To\s*(?P=var1)/si
MiscreantPunch.EvilMacro.DLSSELOS;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11));44696d::i;4c6962::i;7368656c6c3332::i;5368656c6c4578656375746541::i;4b696c6c::i;6f70656e::i;73775f68696465::i;0/Dim\s+(?P<var1>[A-Za-z]{4,12})\s+As\s+Integer\s+(?P=var1)\s*=\s*[0-9]+\s+Do\s+While\s+[0-9]+\s*\>\s*(?P=var1)\s+(?P=var1)\s*=\s*(?P=var1)\s*\+\s*1\s+Loop\s+Dim\s+(?P<var2>[A-Za-z]{4,12})\s+As\s+Integer\s+(?P=var2)\s*=\s*[0-9]+\s+Do\s+While\s+[0-9]+\s*\>\s*(?P=var2)\s+(?P=var2)\s*=\s*(?P=var2)\s*\+\s*1\s+Loop\s+/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.SCOBARWMI;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12);53747252657665727365::i;507574::i;43616c6c42794e616d65::i;586f72::i;4372656174654f626a656374::i;4f70656e::i;42696e617279::i;416363657373::i;52656164::i;5772697465::i;507974686f6e::i;457865635175657279::i;44696d::i
MiscreantPunch.EvilDoc.CommonHeapSpray;Target:2;(0);0424347C0424347C0424347C0424347C0424347C0424347C0424347C0424347C0424347C0424347C0424347C0424347CEB51367CEB51367C
MiscreantPunch.EvilMacro.WMICOT;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12));44696d::i;537472::i;1/Str\s*=\s*Str\s*\+\s*[\x22|\x27]\s*[A-Za-z0-9+\/]{30,}\s*[\x22|\x27]\s+(Str\s*=\s*Str\s*\+\s*[\x22|\x27]\s*[A-Za-z0-9+\/]{30,}\s*[\x22|\x27]\s+)+/si;2d456e63204a41425841454d4150;0/Dim\s+(?P<var1>[A-Za-z0-9]+)\s+As\s+String\s+(?P=var1)\s*=\s*(\x22|\x27)\s*[a-z.]\s*(\x22|\x27)\s+((?P=var1)\s*=\s*(?P=var1)\s*\+\s*(\x22|\x27)\s*[a-z]\s*(\x22|\x27)\s+)+/si;4765744f626a656374::i;437265617465::i;5265706c616365::i;476574::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.GenDL.HTTP.PS.WMI;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13));5075626c6963::i;536574::i;687474703a2f2f::i;4765744f626a656374::i;537061776e496e7374616e6365::i;77696e6d676d74733a5c::i;437265617465::i;2d457865637574696f6e506f6c696379::i;4e65772d4f626a656374202d436f6d4f626a656374::i;6f626a574d4953657276696365::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.RCDS;Target:2;(0>3&1&(2|3|4|5));283029203d20;53706c69742855736572466f726d312e4c6162656c312e43617074696f6e::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.STRXORCLIEXEC;Target:2;(0&1>1&2&3&4&5&6&7&8&9);53747252657665727365::i;20786f7220::i;436f6d6d616e644c696e65::i;457865634d6574686f64::i;42696e617279::i;456e7669726f6e::i;5772697465::i;507574::i;4f70656e::i;4174747269627574652056425f
MiscreantPunch.EvilMacro.XOAOBAEWSNWSS;Target:2;(0&1&2&3&4&5&(6|7|8|9|10));20466f722042696e61727920417320::i;457261736520::i;20786f7220::i;4372656174654f626a6563742822575363726970742e5368656c6c2229::i;2e52756e::i;4372656174654f626a6563742822575363726970742e4e6574776f726b2229::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.WMIPSHELL.PSE;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12));48494444454e5f57494e444f57::i;4765744f626a656374::i;77696e6d676d7473::i;726f6f74::i;6f626a574d4953657276696365::i;53686f7757696e646f77::i;44696d;537061776e496e7374616e6365::i;2e437265617465::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.EvilMacro.OCOCWPEA;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7)&(8|9)&10&11&12);6963726f;61646f6462::i;4f70656e::i;4372656174654f626a656374::i;436872::i;5772697465::i;0/icro(?P<s>[\x21-\x7e]+?)oft[^\r\n]{1,50}(?:Adodb\.(?P=s)|W(?P=s)cript\.(?P=s))/si;(0|1)/Adodb\.(?P<s>[\x21-\x7e]+?)[^\r\n]{1,50}(?:icro(?P=s)oft|W(?P=s)cript\.(?P=s))/si;7368656c6c::if;2e72756e::if;7/shell[^\x22\x27]/i;53617665546f46696c65::i;4174747269627574652056425f::i
MiscreantPunch.EvilMacro.H2SCSVSE;Target:2;(0>20&1&2&3&4&(5|6|7|8));4368722428::i;5368656c6c::i;766248696465::i;53747252657665727365::i;456e7669726f6e::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.DridexCommon;Target:2;(0&1&2&3&4);4966204170706c69636174696f6e2e557365724e616d65203d;4966204170706c69636174696f6e2e526563656e7446696c65732e436f756e74203c2033;5368656c6c;4f70656e;4372656174654f626a656374
MiscreantPunch.EvilMacro.Dridex-LockyCommon;Target:2;(0&1&2&3&4);4966204170706c69636174696f6e2e557365724e616d65203d;4966204170706c69636174696f6e2e526563656e7446696c65732e436f756e74203c2033;53657452657175657374486561646572;4f70656e;4372656174654f626a656374
MiscreantPunch.RTF.CommonExploitConstruct.07112016;Target:0;(0&1&2>5);7b5c7274;7b5c2a5c70656e74657374363636;7d7d7d7b7b7b
MiscreantPunch.EvilMacro.Gen.PShellHTTP.Downloader;Target:2;(0&1&2&3&4&5&6&(7|8|9|10));5368656c6c::i;636d642e657865::i;506f7765725368656c6c::i;446f776e6c6f616446696c65::i;687474703a2f2f::i;65786974::i;50726976617465::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.AOSTRSAMSHTTP;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11));53747252657665727365;456e7669726f6e::i;5368656c6c2e4170706c69636174696f6e::i;2e4f70656e::i;4d53584d4c322e584d4c48545450::i;2e726573706f6e7365::i;2e7772697465::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.Dridex-LockyCommonM2;Target:2;(0&1&2&3);4966204170706c69636174696f6e2e557365724e616d65203d;4966204170706c69636174696f6e2e526563656e7446696c65732e436f756e74203c2033;5368656c6c::i;4172726179::i
MiscreantPunch.EvilMacro.OCOCWPEA.M2;Target:2;(0&1&2&3&4&5>20&(6|7));6963726f;4f70656e::i;4372656174654f626a656374::i;436872::i;5772697465::i;496620284d696428;0/icro(?P<s>[^s]{1,20})oft.*?(?:Adodb\.(?P=s)|W(?P=s)cript\.(?P=s))/si;0/Adodb\.(?P<s>[^s]{1,20}).*?(?:icro(?P=s)oft|W(?P=s)cript\.(?P=s))/si
MiscreantPunch.EvilMacro.B64ChrDownloader;Target:2;(0<50&1&(2|3|4)&(5|6|7)&(8|9|10)&(11|12|13)&(14|15|16)&(17|18|19|20|21));4368722428::i;456e7669726f6e::i;64584a7362573975;56796247317662;31636d78746232;56564a4d52473933626d78765957525562305a7062475658;565354455276643235736232466b564739476157786c56;56556b784562336475624739685a465276526d6c735a56;515642515245465551;4651554552425645;425546424551565242;6332686c6247777a4d;4e6f5a5778734d7a;7a6147567362444d79;5532686c624778466547566a6458526c;4e6f5a5778735258686c593356305a;5461475673624556345a574e3164;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.ChrObsf.Gen;Target:2;(0&1>200&2&3&(4|5|6|7));53747252657665727365;4368722428;2e657865::i;766248696465::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.ASOXUF;Target:2;(0>300&1&2&3&4&5>100&(6|7|8|9));417320537472696e67;4f70656e::i;586f72::i;55736572466f726d;3/UserForm[^\r\n\s]*\.Text/si;417320426f6f6c65616e;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.DCSROXSC;Target:2;(0&1&2&3&4&5&(6|7|8|9));496620446f63756d656e74732e436f756e74203e2030;2e657865;53747252657665727365;4f70656e;586f72;537472436f6e76;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.PSB64Drop;Target:2;(0&1&2&3&(4|5|6|7));737472696e67::i;0/(([A-Za-z]{5,15})\d{1,2}\s*=\s*(\x22|\x27)\s*(?:[A-Za-z0-9+\/]{5})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})\s*(\x22|\x27)\s+){20,}/si;2e657865::i;5368656c6c::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
#MiscreantPunch.EvilMacro.OCOCWPEA.M3.20160726;Target:2;(0&(1|2)&3&4&5&6);6963726f;0/icro(?P<s>[\x21-\x7e]+?)oft.*?(?:Adodb\.(?P=s)|W(?P=s)cript\.(?P=s))/si;0/Adodb\.(?P<s>[\x21-\x7e]+?).*?(?:icro(?P=s)oft|W(?P=s)cript\.(?P=s))/si;436f6e6e656374::i;50757446696c65::i;5772697465::i;53617665546f46696c65::i
MiscreantPunch.H1N1Macro.Jul272016;Target:2;(0&1&2>10&3&4&(5|6|7|8)&9);4372656174654f626a656374::i;53656c6563742043617365::i;202b2031;417320496e7465676572::i;205468656e::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;4/Then\s+Dim\s+(?P<var>[a-z0-9]+)\s+As\s+Integer\s+(?P=var)\s*=\s*\d+\s+(?P<var2>[a-z0-9]+)\s*=\s*\d+\s*\+\s*(?P=var)\s+Select\s+Case\s+(?P=var)\s+case\s+\d+\s+(?P=var)\s*=\s*(?P=var)\s*\+\s*1\s+case\s+\d+\s+(?P=var)\s*=\s*(?P=var)\s*\+\s*\d+\s+case\s+\d+\s+(?P=var)\s*=\s*(?P=var)\s*\+\s*(?P=var2)\s+End\s+Select.+Then\s+Dim\s+(?P<var3>(?!(?:(?P=var)|(?P=var2)))[a-z0-9]+)\s+As\s+Integer\s+(?P=var3)\s*=\s*\d+\s+(?P<var4>(?!(?:(?P=var)|(?P=var2)|(?P=var3)))[a-z0-9]+)\s*=\s*\d+\s*\+\s*(?P=var3)\s+Select\s+Case\s+(?P=var3)\s+case\s+\d+\s+(?P=var3)\s*=\s*(?P=var3)\s*\+\s*1\s+case\s+\d+\s+(?P=var3)\s*=\s*(?P=var3)\s*\+\s*\d+\s+case\s+\d+\s+(?P=var3)\s*=\s*(?P=var3)\s*\+\s*(?P=var4)\s+End\s+Select/si
MiscreantPunch.EvilMacro.OSNFBEPA;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12));4f70656e;5368656c6c;76624e6f726d616c466f637573;42696e617279;456e7669726f6e;507574;41707044617461::i;2e657865::i;66696c652063616e6e6f7420626520646973706c617965642e20596f75722076657273696f6e20646f65736e7420737570706f7274::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;576f726b626f6f6b5f4f70656e::i
MiscreantPunch.EvilMacro.ASABADSC;Target:2;(0>200&1>80&2&3&4&5&(6|7|8|9));417320537472696e67;417320426f6f6c65616e;41707044617461::i;5368656c6c;436872;456e7669726f6e;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.SSBISH.1;Target:2;(0&1&2&3&4&5&6>20&7>20&8>20&9&(10|11|12|13));202b203139;202b203131;5368656c6c20::i;44696d20::i;224122::i;227a22::i;417320426f6f6c65616e::i;417320496e7465676572::i;417320537472696e67::i;3/Dim\s+[a-z]{6,60}\s+As\s+(?:Boolean|Integer|String)\s*\nDim\s+[a-z]{6,60}\s+As\s+(?:Boolean|Integer|String)\s*\nDim\s+[a-z]{6,60}\s+As\s+(?:Boolean|Integer|String)\s*\nDim\s+[a-z]{6,60}\s+As\s+(?:Boolean|Integer|String)\s*\n/;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.AOSTRS64.1;Target:2;(0&1&2&(3|4|5|6));5368656c6c20::i;53526576657273654d6f6420262053747252657665727365284d696428::i;204465636f64653634::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.H1N1Macro.Aug082016;Target:2;(0&1>10&2&3&4&(5|6|7|8)&9);53656c6563742043617365::i;202b2031;417320496e7465676572::i;205468656e::i;456e642053656c656374::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;4/End\s+Select\s+Dim\s+[a-z0-9]+\s+As\s+String\s+(?P<var>[a-z0-9]+)\s*=\s*\d+\s+Select\s+Case\s+(?P=var)\s+case\s+\d+\s+(?P=var)\s*=\s*(?P=var)\s*\+\s*1\s+case\s+\d+\s+(?P=var)\s*=\s*(?P=var)\s*\+\s*(?P=var)\s+case\s+Else\s+(?P=var)\s*=\s*(?P=var)\s*\-\s*1\s+End\s+Select\s+(?P<var2>[a-z0-9]+)\s*=\s*\d+\s+Select\s+Case\s+(?P=var2)\s+case\s+\d+\s+(?P=var2)\s*=\s*(?P=var2)\s*\+\s*1\s+case\s+\d+\s+(?P=var2)\s*=\s*(?P=var2)\s*\+\s*(?P=var2)\s+case\s+Else\s+(?P=var2)\s*=\s*(?P=var2)\s*\-\s*1\s+End\s+Select\s+/si
#MiscreantPunch.CVE-2012-0158.ObfusAX.1;Target:0;(0&1&2&3=0&4);3930393039303930::i;7b5c7274::i;6f626a64617461::i;30344246304431424438423835443131314231364130306330463032383336323830::i;2/4.{0,20}?B.{0,20}?F.{0,20}?0.{0,20}?D.{0,20}?1.{0,20}?B.{0,20}?D.{0,20}?8.{0,20}?B.{0,20}?8.{0,20}?5.{0,20}?D.{0,20}?1.{0,20}?1.{0,20}?1.{0,20}?B.{0,20}?1.{0,20}?6.{0,20}?A.{0,20}?0.{0,20}?0.{0,20}?c.{0,20}?0.{0,20}?F.{0,20}?0.{0,20}?2.{0,20}?8.{0,20}?3.{0,20}?6.{0,20}?2.{0,20}?8.{0,20}?0/si
MiscreantPunch.EvilMacro.CBNSTROBF0808;Target:2;(0>8&1&2&3&4&5&(6|7|8|9|10)&(11|12|13|14|15|16|17|18));43616c6c42794e616d65::i;5269676874284c65667428::i;4572722e526169736520::i;4372656174654f626a656374::i;2b203129::i;203129::i;2254454722::i;2245544722::i;2245475422::i;2254474522::i;2247544522::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i;446f63756d656e745f436c6f7365::i
MiscreantPunch.EvilMacro.COGSFOS.Cerb0809;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11)&12);4372656174654f626a656374::i;4765745370656369616c466f6c646572::i;4f70656e::i;53656e64::i;7772697465::i;73617665746f66696c65::i;5368656c6c::i;46756e6374696f6e::i;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;7/Function\s+(?P<var>[a-z]+)\s*\(\s*\)\s+Dim\s+(?P<var2>[a-z]+)\s+(?P=var2)\s*=\s*Array\s*\(((\x22|\x27)[A-Za-z0-9]+(\x22|\x27),\s)*(\x22|\x27)[A-Za-z0-9]+(\x22|\x27)\)\s*\(\d{1,2}\)\s+(?P=var)\s*=\s*(?P=var2)\s+End\s+Function/si
MiscreantPunch.EvilMacro.AOVALLOCRTLMSTRRWD;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4c696220226b65726e656c33322220416c69617320225669727475616c416c6c6f6322::i;2252746c4d6f76654d656d6f727922::i;53747252657665727365::i;44696d20::i;2349662057696e3634205468656e::i;23456c736549662057696e3332205468656e::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.RBEB64SC;Target:2;(0<50&1&2&3&4&5&6&(7|8|9|10));5242797465456e6372797074;5368656c6c::i;537472436f6e76;766246726f6d556e69636f6465;586f72::i;44696d::i;5/Dim\s+(?P<var>[a-z0-9]+)\s+As\s+String\s+(?P=var)\s*=\s*RByteEncrypt\s*\(\s*Decode64\s*\(\s*(\x22|\x27)\s*(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})\s*(\x22|\x27)/si;446f63756d656e745f4f70656e::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i
MiscreantPunch.EvilMacro.HEXDLR;Target:2;(0&1&2&3&4&5&6);3431363337343639373636353538346636323661363536333734*3733363337323639373037343265::i;3635373337303666366537333635????366636343739::i;3435366537363639373236663665::i;36343666363436323265????????3732363536313664::i;3265373237353665::i;4d6963726f736f6674204f6666696365::i;5c564241
MiscreantPunch.EvilMacro.SRDEPICO2CS;Target:2;(0<10&1<10&2&3&4&(5|6|7|8|9|10|11|12));53747252657665727365::i;44656372797074455049::i;436872::i;4f637432446563::i;5368656c6c::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.EvilMacro.ORCOCSWSA;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));4f70656e::i;52756e::i;4372656174654f626a656374::i;436872::i;53617665546f46696c65::i;5772697465::i;474554::i;537461747573203d20323030::i;726573706f6e7365426f6479::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AOCROCHRRB;Target:2;(0&1&(2|3)&(4|5|6|7|8|9|10|11));2e726573706f6e7365426f6479::i;4372656174654f626a6563742843687228::i;7368656c6c::i;2e52756e::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AOOBJSSCEV;Target:2;(0&1&2&3&4=0&(5|6|7|8|9|10|11|12)&13);2234::i;4576616c::i;536372697074436f6e74726f6c::i;262043687228222648222026204d696428::i;34413533363337324f363937303734::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i;0/\x224[^a-f0-9\x22]{0,20}A[^a-f0-9\x22]{0,20}5[^a-f0-9\x22]{0,20}3[^a-f0-9\x22]{0,20}6[^a-f0-9\x22]{0,20}3[^a-f0-9\x22]{0,20}7[^a-f0-9\x22]{0,20}2[^a-f0-9\x22]{0,20}O[^a-f0-9\x22]{0,20}6[^a-f0-9\x22]{0,20}9[^a-f0-9\x22]{0,20}7[^a-f0-9\x22]{0,20}0[^a-f0-9\x22]{0,20}7[^a-f0-9\x22]{0,20}4/i
MiscreantPunch.EvilMacro.AORFCRCORLFE;Target:2;(0&1&2&3&4&5&6&7);2e526563656e7446696c65732e436f756e74::i;2e52756e20::i;4372656174654f626a656374::i;526967687428::i;4c65667428::i;4174747269627574652056425f::i;2e46696c65457869737473::i;0/\.RecentFiles\.Count\s+[<>=]/si
MiscreantPunch.EvilMacro.H1N1.GoListenToAlisonGoldChineseFoodItsTotesLegit;Target:2;(0&1&2>3&3>1&4>1&5>1&6>1&7>1&8&9>3&10);2e537061776e696e7374616e6365::i;456e7669726f6e::i;53747252657665727365::i;526967687428::i;4c65667428::i;4d696428::i;554361736528::i;4c4361736528::i;4765744f626a656374::i;202f20::i;2e457865634d6574686f64::i
MiscreantPunch.EvilMacro.AFCRUSRH;Target:2;(0&1&2&3);54454722::i;3d204170706c69636174696f6e2e526563656e7446696c65732e436f756e74203c::i;2e52756e20::i;2e53657452657175657374486561646572::i
MiscreantPunch.EvilMacro.SPSCOEVB;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));53746172742d50726f63657373::i;5368656c6c::i;4372656174654f626a656374::i;456e7669726f6e::i;5642536372697074::i;526567457870::i;2e657865::i;5265706c616365::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.Locky.Aug17;Target:2;(0&1&2&3&4&5&6&(7|8)&(9|10|11|12|13|14|15|16));6963726f::i;44696d20::i;53706c6974::i;436872::i;6f6674::i;6372697074::i;41646f6462::i;0/icro(?P<s>[^s]{1,20})oft.*?(?:Adodb\.(?P=s)|W(?P=s)cript\.(?P=s))/si;0/Adodb\.(?P<s>[^s]{1,20}).*?(?:icro(?P=s)oft|W(?P=s)cript\.(?P=s))/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.EvilMacro.PSB64SEN;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14));5368656c6c::i;2d656e63::i;2d4578::i;2d4e::i;456e6420537562::i;0/[A-Za-z0-9]+\s*=\s*(\x22|\x27)\s*(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{6})\s*(\x22|\x27)\s+/isg;0/(?P<var>[A-Za-z0-9]+)\s*=\s*(\x22|\x27)\s*[A-Za-z]+\s*(\x22|\x27)\s+(?P<var2>[A-Za-z0-9]+)\s*=\s*(\x22|\x27)\s*[A-Za-z]+\s*(\x22|\x27)\s+[A-Za-z0-9]+\s*=\s*(?P=var)\s*\+\s*(?P=var2)\s+/isg;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.MSBITSDL;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));5368656c6c::i;2f6320636d642e657865::i;2f63206269747361646d696e::i;2f646f776e6c6f6164::i;2f7072696f7269747920666f726567726f756e64::i;2f7472616e73666572::i;2e657865::i;41505044415441::i;766248696465::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.EvilMacro.DRGCEFCOML;Target:2;(0>15&1&2&3&4&5&(6|7|8|9|10|11|12|13));44696d::i;4372656174654f626a656374::i;4d53536372697074436f6e74726f6c::i;6f5363726970742e4c616e6775616765203d20224a53637269707422::i;6f5363726970742e4576616c::i;0/((?P<var>[a-z0-9]+)\s*=\s*(?P=var)\s*&\s*)+/isg;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
##MiscreantPunch.EvilMacro.LockyAug19;Target:2;(0&1>15&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;43616c6c42794e616d65::i;4572722e5261697365204e756d6265723a3d::i;4372656174654f626a656374::i;3c2033205468656e::i;4c43617365::i;46756e6374696f6e::i;6/Function\s+(?P<var>[a-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*[A-Za-z0-9]+\s*\(\s*Array\s*\((\s*s\s*\(\d{2,3}\s*\,\s*\x22\s*[A-Z ]+\s*\x22\s*\,\s*\d{2,3}\s*\)\,\s*)+/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.SuspiciousDoc.CrackedVersion;Target:2;(0&(1|2|3|4|5|6|7|8));52655061636b206279205350656369616c695354::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.EvilMacro.DRLTOCOC;Target:2;(0&1>15&2>15&3&4&5&6&7);44696d::i;525472696d::i;4c5472696d::i;4f70656e::i;4372656174654f626a656374::i;436872::i;456e7669726f6e::i;0/Dim\s+(?P<var>[A-Za-z0-9]+)\s*,\s*(?P<var2>[A-Za-z0-9]+)\s*,\s*(?P<var3>[A-Za-z0-9]+)\s*As\s+(?:String|Long)\s+(?P=var)\s*=\s*(\x22|\x27)\s{5,}[^\r\n]+\s{5,}(\x22|\x27)\s+(?P=var2)\s*=\s*LTrim\s*\(\s*(?P=var)\s*\)\s+(?P=var3)\s*=\s*RTrim\s*\(\s*(?P=var2)\s*\)/si
MiscreantPunch.EvilMacro.PShellGenDL;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18));5368656c6c::i;636d642e657865::i;506f7765727368656c6c::i;6e65772d6f626a656374::i;776562636c69656e74::i;646f776e6c6f616466696c65::i;68747470::i;2554454d5025::i;7374617274::i;2e657865::i;65786974::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ACOTCBNDSF;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17));4174747269627574652056425f::i;4372656174654f626a656374::i;3c3e20323030205468656e::i;43616c6c42794e616d65::i;526e64::i;4765745370656369616c466f6c646572::i;4170706c69636174696f6e2e52756e::i;4c656e::i;436872::i;76624f4b6f6e6c79::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.H1N1.Aug232016;Target:2;(0&1>1&2>1&3>1&4&5&6&7&8&9&10&11>25);537061776e696e7374616e6365::if;53747252657665727365::if;5269676874::if;4c656674::if;4d6964::if;5543617365::if;4c43617365::if;4372656174654f626a656374::if;1/StrReverse\s*\(\s*[\x22\x27][^\x22\x27]+[\x22\x27].*?StrReverse\s*\(\s*[\x22\x27][^\x22\x27]+[\x22\x27]/si;2/Right\s*\(\s*[\x22\x27][^\x22\x27]+[\x22\x27].*?Right\s*\(\s*[\x22\x27][^\x22\x27]+[\x22\x27]/si;3/Left\s*\(\s*[\x22\x27][^\x22\x27]+[\x22\x27].*?Left\s*\(\s*[\x22\x27][^\x22\x27]+[\x22\x27]/si;0a27
#MiscreantPunch.EvilMacro.DRGCEFCOML.M2;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12));44696d::i;4372656174654f626a656374::i;6f5363726970742e4c616e6775616765203d20::i;6f5363726970742e4576616c::i;0/((?P<var>[a-z0-9]+)\s*=\s*(?P=var)\s*&\s*.+)+oScript\s*\.\s*Eval\s*\(\s*(?P=var)\s*\)/isg;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ACERNCOTLF.Aug24;Target:2;(0&1>15&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;43616c6c42794e616d65::i;4572722e5261697365204e756d6265723a3d::i;4372656174654f626a656374::i;3c2033205468656e::i;4c43617365::i;46756e6374696f6e::i;6/Function\s+(?P<var>[a-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*[A-Za-z0-9]+\s*\(\s*Array\s*\((\s*\w\s*\(\d{2,3}\s*\,\s*\d{2,3}\s*,\s*\x22\s*[A-Z ]+\s*\x22\s*\),)+/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ACERNCOTLF.Aug24.M2;Target:2;(0&1>15&2&3&4&5&6&7);4174747269627574652056425f::i;43616c6c42794e616d65::i;4572722e5261697365204e756d6265723a3d::i;4372656174654f626a656374::i;3c2033205468656e::i;4c43617365::i;46756e6374696f6e::i;6/Function\s+(?P<var>[a-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*[A-Za-z0-9]+\s*\(\s*Array\s*\((\s*\w\s*\(\d{2,3}\s*\,\s*\d{2,3}\s*,\s*\x22\s*[A-Z ]+\s*\x22\s*\),)+/si
MiscreantPunch.EvilMacro.ACERNCOTLF.Aug29;Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;4572722e5261697365::i;4372656174654f626a656374::i;537461747573203c3e20323030::i;436f756e74::i;5543617365::i;46756e6374696f6e::i;6/Function\s+(?P<var>[a-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*.+Array.+(\w\s*\(\d{2,3}\s*\,\s*\d{2,3}\s*,\s*\x22\s*[A-Z ]+\s*\x22\s*\)\s*,\s*_\s+)+/si
MiscreantPunch.EvilMacro.AVBCOLE;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;4372656174654f626a656374::i;4c616e6775616765::i;4576616c::i;0/((?P<var>[a-z0-9]+)\s*=\s*(?P=var)\s*\&\s*.+)+Set\s*(?P<var2>[A-Za-z0-9]+)\s*=\s*CreateObject\s*\(.+\)\s+(?P=var2)\s*\.\s*Language\s*=\s*.+(?P=var2)\s*\.\s*Eval\s*\(\s*(?P=var)\s*\)/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AVBCOLE.M2;Target:2;(0&1&2&3>150&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;4372656174654f626a656374::i;4c616e6775616765::i;203d20;0/((?P<var>[a-z0-9]+)\s*=\s*(?P=var)\s*\&\s*.+)+Set\s*(?P<var2>[A-Za-z0-9]+)\s*=\s*CreateObject\s*\(.+\)\s+(?P=var2)\s*\.\s*Language\s*=\s*([a-z0-9]+\s*(&\s*)?)+/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.COMXWGSTX;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18));4372656174654f626a656374::i;5370656369616c466f6c64657273::i;547970654c6962::i;4f70656e::i;53656e64::i;726573706f6e7365426f6479::i;2e65786522::i;41646f::i;7772697465::i;73617665746f66696c65::i;0/CreateObject\s*\(\s*\x22Ado\x22\s*&\s*\x22db\.St\x22\s*&\s*\x22ream\x22\s*\)\s+/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ACERNCOTLF.M3;Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;4572722e5261697365::i;4372656174654f626a656374::i;537461747573203c3e20323030::i;52756e::i;5543617365::i;46756e6374696f6e::i;6/Function\s+(?P<var>[a-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*.+Array.+(\w\s*\(\d{2,3}\s*\,\s*\d{2,3}\s*,\s*\x22\s*[A-Z ]+\s*\x22\s*\)\s*,\s*_\s+)+/si
#MiscreantPunch.EvilMacro.AVBCOP;Target:2;(0&1&2>15&3&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;4576616c::i;44696d::i;4372656174654f626a656374::i;0/((?P<var>[A-Z0-9]+)\s*=\s*(?P=var)(\s*&\s*[A-Z0-9]+){5,})+/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.RTLMVSTRCRW;Target:2;(0&1&2&3);416c696173202252746c4d6f76654d656d6f727922::i;416c696173202243616c6c57696e646f7750726f634122::i;53747252657665727365::if;4c696220226b65726e656c33322220416c69617320224865617043726561746522::i
MiscreantPunch.EvilMacro.AOSTRRUNOPROCREXPENV;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));2e52756e205374725265766572736528::i;77644e6f50726f74656374696f6e::i;457870616e64456e7669726f6e6d656e74537472696e6773::i;4372656174654f626a656374::i;4174747269627574652056425f437573746f6d697a61626c65203d::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.AOARZREP;Target:2;(0&1&2>5&3>1&4&5&6>5&7&8&9);4f70656e::fi;4372656174655465787446696c65::fi;283029203d::i;7265706c616365::fi;4765745370656369616c466f6c646572::fi;4372656174654f626a656374::if;283129203d::i;2/\(0\)\s=\s*\d.+?\(0\)\s*=\s*\d.+?\(0\)\s*=\s*\d.+?\(0\)\s=\s*\d.+?\(0\)\s*=\s*\d/si;3/replace\s*\(\s*(?P<var>[^,\s]+).+?(?P=var)\s*=\s*replace\s*\(\s*(?P=var)/si;6/\(1\)\s=\s*\d.+?\(1\)\s*=\s*\d.+?\(1\)\s*=\s*\d.+?\(1\)\s=\s*\d.+?\(1\)\s*=\s*\d/si
MiscreantPunch.EvilMacro.SGOXMCODE;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&(12|13|14|15|16|17|18|19));4174747269627574652056425f::i;44696d::i;456e7669726f6e::i;2e7068703f686f73746e616d653d::i;26757365726e616d653d::i;26646f6d61696e3d::i;4372656174654f626a656374::i;4d53584d4c32::i;584d4c48545450::i;4f70656e::i;474554::i;53656e64::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ACEDITCE;Target:2;(0&1&2>300&3>1000&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;44696d::i;43617365::i;203d20::i;1/Dim\s+(?P<var>[A-Za-z0-9]+)\s*As\s+String\s+(?P=var)\s*=\s*[\x22\x27]\s*(?P<var2>[A-Za-z0-9]+)\s*[\x22\x27]\s+If\s*(?P=var)\s*=\s*[\x22\x27]\s*(?P=var2)\s*[\x22\x27]\s*Then\s+(?P<var3>[A-Za-z0-9]+)\s*=\s*(?P=var3)\s*\+\s*\d{1,3}\s+Select\s+Case\s*(?P=var3)\s+Case\s*\d{1,3}\s+(?P=var3)\s*=\s*(?P=var3)\s*\+\s*\d{1,3}\s+Case\s+Else\s+(?P=var3)\s*=\s*(?P=var3)\s*\+\s*\d{1,3}\s+End\s+Select/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AVBCOP.M2;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;416464436f6465::i;52756e::i;44696d::i;4372656174654f626a656374::i;0/((?P<var>[A-Z0-9]+)\s*=\s*(?P=var)(\s*&\s*[A-Z0-9]+){5,})+/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.InkPicture1.GOSWCER;Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;496e6b50696374757265315f5061696e746564::i;4765744f626a656374::i;53686f7757696e646f77::i;437265617465::i;4572722e5261697365::i;44696d::i;4572722e4465736372697074696f6e::i
MiscreantPunch.EvilMacro.ObsPShell.SRCER;Target:2;(0&1>5&2&3>500&4&5&6&(7|8|9|10|11|12|13|14));4174747269627574652056425f::i;53747252657665727365::i;436872::i;3078;456e7669726f6e::i;657865::i;52756e::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AVBCEALUW;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;226b65726e656c33322220416c69617320224372656174654576656e744122::i;4c43617365::i;5543617365::i;57696e3634::i;57696e3332::i;44696d::i;6/Dim\s*[^\r\n]+\s*As\s*(?:String|Long)\s+(?P<var>[A-Za-z0-9]+)\s*=\s*\d{1,3}\s+While\s*(?P=var)\s*(?:<|>)\s*\d{1,3}\s+(?P=var)\s*=\s*(?P=var)\s*(?:\+|-)\s*\d{1,3}\s+/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ADCEBATD;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;446f63756d656e7420697320636f6e666964656e7469616c::i;506c6561736520646f206e6f7420636f7079::i;436872::i;5368656c6c::i;0/Dim\s*(?P<func>[A-Za-z0-9]+)\s*,\s*(?P<var>[A-Za-z0-9]+)\s*,\s*(?P<var2>[A-Za-z0-9]+)\s*,\s*(?P<var3>[A-Za-z0-9]+)\s*,\s*(?P<var4>[A-Za-z0-9]+)\s*As\s*String\s+(?P=var)\s*=\s*(Chr\(\d{2,3}\)\s*\+\s*)+Chr\(\d{2,3}\)\s+(?P=var2)\s*=\s*(Chr\(\d{2,3}\)\s*\+\s*)+Chr\(\d{2,3}\)\s+(?P=var3)\s*=\s*(Chr\(\d{2,3}\)\s*\+\s*)+Chr\(\d{2,3}\)\s+(?P=var4)\s*=\s*(Chr\(\d{2,3}\)\s*\+\s*)+Chr\(\d{2,3}\)\s+(?P=func)\s*=\s*(?P=var)\s*\+\s*(?P=var2)\s*\+\s*(?P=var3)\s*\+\s*(?P=var4)/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ACOSSTFD;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;4372656174654f626a656374::i;5772697465::i;53617665537472696e67546f46696c65::i;44696d::i;4/Dim\s+(?P<var>[A-Za-z0-9]+)\s*,\s*(?P<var2>[A-Za-z0-9]+)\s*,\s*(?P<var3>[A-Za-z0-9]+)\s*As\s+String\s+(?P=var)\s*=\s*[\x22\x27]\s+[A-Z]+\s+[\x22\x27]\s+(?P=var2)\s*=\s*(?:LTrim|RTrim)\s*\(\s*(?P=var)\s*\)\s+(?P=var3)\s*=\s*(?:LTrim|RTrim)\s*\(\s*(?P=var2)\s*\)/si
MiscreantPunch.EvilMacro.SLZCEVBH;Target:2;(0>5&1&2&3&4&5&(6|7|8|9|10|11|12|13));4c5a43727970746f::i;5368656c6c::i;456e7669726f6e::i;51756974::i;436872::i;766248696465::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.EvilMacro.AVBCORVBH;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;4372656174654f626a656374::i;52756e::i;766248696465::i;0/([A-Za-z]+\s*=\s*\x22[^\x22]+\x22\s+){1,4}[A-Za-z]+\s*=\s*([A-Za-z]{10,20}\s*\+?\s*){1,6}/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AVBDCOCC;Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;44696d::i;4372656174654f626a656374::i;436872::i;43616c6c42794e616d65::i;4372656174655465787446696c65::i;5772697465::i;1/Dim\s+(?P<var>[A-Za-z0-9]+)\s*\(\d{1,3}\s*\)\s+((?P=var)\s*\(\d{1,3}\s*\)\s*=\s*\d{1,3}\s+)+/si
MiscreantPunch.EvilMacro.AVBIPIRFS;Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;496d675f5061696e746564::i;496e6b52656374616e676c65::i;52756e::i;46756e6374696f6e::i;53656e64::i;4/Function\s+(?P<var>[A-Za-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*Array\s*\((\w\s*\(\s*\x22[A-Za-z \.]+\s*\x22\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*\)\s*,\s*_?\s+)+/si
MiscreantPunch.EvilMacro.RCOPA;Target:2;(0&1&2&(3|4|5|6|7|8|9|10));52756e::i;4372656174654f626a656374::i;0/(?P<var>[a-z]+)\s*=\s*(?P=var)\s*(&\s*[a-z]{5,12}\s*\(\s*\)\s*){10,}/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AOPSHRBRUN;Target:2;(0&1&2&3&4&5&6&7);49496e6b52656374616e676c65::if;72756e::if;526563656e7446696c65732e436f756e74::if;526573706f6e736554657874::if;53657452657175657374486561646572::if;6f70656e::if;73656e64::if;4174747269627574652056425f
MiscreantPunch.EvilMacro.LRCOPF;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4c616e6775616765::i;52756e::i;4372656174654f626a656374::i;70726f74656374656420646f63756d656e74206661696c6564::i;46756e6374696f6e::i;4/(Function\s*(?P<var2>[a-z]{5,})\s*\(\s*\)\s+Dim\s*(?P<var>[a-z]{5,})\s+(?P=var)\s*=\s*[\x22\x27]\s*[^\x22\x27]+[\x22\x27]\s+[a-z]{5,}\s*=\s*(?P=var)\s+End\s+Function)+/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.AVBIPIRFS.M2;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;5f5061696e746564::i;49496e6b52656374616e676c65::i;46756e6374696f6e::i;4372656174654f626a656374::i;3/Function\s+(?P<var>[A-Za-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*Array\s*\((\w\s*\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\x22[A-Za-z \.;:]+\s*\x22\)\s*,\s*_?\s+)+/si
MiscreantPunch.EvilMacro.PaintedAutoRunStruct;Target:2;(0&1&2&3&4);4174747269627574652056425f::i;5f5061696e746564::i;49496e6b52656374616e676c65::i;5075626c6963::i;3/Public\s+Sub\s*[A-Za-z0-9]+_Painted\s*\(\s*ByVal\s+[^\r\n]+As\s*Long\s*,\s*ByVal\s+[^\r\n]+As\s+IInkRectangle\s*\)/si
MiscreantPunch.EvilMacro.AVLASOCEXU;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));44696d::i;4c696220226b65726e656c33322220416c696173::i;4c696220227573657233322220416c696173::i;53656c6563744f626a656374::i;4372656174654576656e7441::i;52746c4d6f76654d656d6f7279::i;586f72::i;5543617365::i;5072696e744f7574::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.SERRECO;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;4372656174654f626a656374::i;526567457870::i;5265706c616365::i;5368656c6c::i;0/\(\s*[\x22\x27]c(?P<var>[\x20-\x7e]+)m\1d\1\s*\1\/\1C\1\s*\1b\1i\1t\1s\1a\1d\1m\1i\1n\1\s*/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AVLASOCEXU.M2;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17));4174747269627574652056425f::i;4c696220226b65726e656c33322220416c696173::i;4c696220227573657233322220416c696173::i;53656c6563744f626a656374::i;4372656174654576656e7441::i;52746c4d6f76654d656d6f7279::i;5543617365::i;53747252657665727365::i;507574::i;5669727475616c416c6c6f63::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AVBDIWTULR.M2;Target:2;(0&1&2&(3|4|5|6|7|8|9|10));44696d::i;2349662057696e3634205468656e::i;0/(?P<var>[a-z]+)\s*=\s*(?:UCase|LCase|Mid|Right|Left)?\s*\(?\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27]\s*\)?(?:,\s*\d{1,2})?(?:,\s*\d{1,2})?\)?\s*[\+&]\s*(?:UCase|LCase|Mid|Right|Left)\s*\(?\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27]\s*\)?(?:,\s*\d{1,2})?(?:,\s*\d{1,2})?\)?(\s*[\+&]\s*(?:UCase|LCase|Mid|Right|Left)?\s*\(?\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27]\s*\)?(?:,\s*\d{1,2})?(?:,\s*\d{1,2})?\)?)?\s+(?P=var)\s*=\s*(?:UCase|LCase|Mid|Right|Left)?\s*\(?\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27]\s*\)?(?:,\s*\d{1,2})?(?:,\s*\d{1,2})?\)?\s*[\+&]\s*(?:UCase|LCase|Mid|Right|Left)\s*\(?\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27]\s*\)?(?:,\s*\d{1,2})?(?:,\s*\d{1,2})?\)?(\s*[\+&]\s*(?:UCase|LCase|Mid|Right|Left)?\s*\(?\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27]\s*\)?(?:,\s*\d{1,2})?(?:,\s*\d{1,2})?\)?)?/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.AVBIPIRFS.M3;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;5f5061696e746564::i;49496e6b52656374616e676c65::i;46756e6374696f6e::i;4372656174654f626a656374::i;3/Function\s+(?P<var>[A-Za-z0-9]+)\s*\(\s*\)\s+(?P=var)\s*=\s*Array\s*\((\w\s*\(\s*\x22[A-Za-z \.;:]+\s*\x22\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*\)\s*,\s*_?\s+)+/si
MiscreantPunch.EvilMacro.SERRECO.M2;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;4372656174654f626a656374::i;526567457870::i;5265706c616365::i;5368656c6c::i;0/\(\s*[\x22\x27]c(?P<var>[a-zA-z]{5})m\1d\1\s*\1\/\1C\1\s*\1p\1o\1w\1e\1r\1s\1h\1e\1l\1l\1\.\1e\1x\1e\1\s*/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AVBCOP.M2;Target:2;(0&1&2>25&3&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;4576616c::i;44696d::i;4372656174654f626a656374::i;0/((?P<var>[A-Z0-9]+)\s*=\s*(?P=var)(\s*&\s*[A-Z0-9]+\s*\(\s*\)){10,})+/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.Locky.Sep30;Target:2;(0&1&2&3&4&5&(6|7)&(8|9|10|11|12|13|14|15));6963726f::i;44696d20::i;53706c6974::i;6f6674::i;6372697074::i;41646f6462::i;0/icro(?P<s>[^s]{1,20})oft.*?(?:Adodb\.(?P=s)|W(?P=s)cript\.(?P=s))/si;0/Adodb\.(?P<s>[^s]{1,20}).*?(?:icro(?P=s)oft|W(?P=s)cript\.(?P=s))/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ADCOCCBN;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var2>[A-Za-z0-9]{5,15})\s+(?P=var2)\s*=\s*\d{1,3}\s+If\s*(?P=var2)\s*[<>=]\s*\d{1,3}\s*Then/ig;4372656174654f626a656374::i;43616c6c42794e616d65::i;1/Dim\s+(?P<var>[A-Za-z0-9]{4,15})\s*\(\s*\d{1,3}\s*\)\s+((?P=var)\s*\(\s*\d{1,3}\s*\)\s*=\s*\d{1,3}\s+){3,}/ig
MiscreantPunch.EvilMacro.FXIWTULA;Target:2;(0&1&2&3&4&5&6);466f72::i;586f72::i;2349662057696e3634205468656e::i;55426f756e64::i;4c696220226b65726e656c33322220416c69617320224372656174654576656e744122::i;4c696220226e74646c6c2220416c696173202252746c4d6f76654d656d6f727922::i;0/For\s+(?P<var>[a-z]{5,20})\s*=\s*\d{1,3}\s*To\s*[a-z]{5,20}\s+Select\s+Case\s*(?P=var)\s+Case\s*\d{1,3}\s*To\s*\d{1,3}\s+(?P<var2>[a-z]{5,20})\s*\(\s*(?P=var)\s*\)\s*=\s*(?P=var)\s*[\+-]\s*\d{1,3}\s+Case\s*\d{1,3}\s*To\s*[a-z]{5,20}\s+(?P=var2)\s*\(\s*(?P=var)\s*\)\s*=\s*(?P=var)\s*[\+-]\s*\d{1,3}/si
MiscreantPunch.EvilMacro.GOSWCER.M2;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14));4174747269627574652056425f::i;537061776e496e7374616e63655f::i;4765744f626a656374::i;53686f7757696e646f77203d2030::i;43726561746528::i;4572722e536f75726365::i;4572722e4e756d626572::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.SERRECO.M3;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;4372656174654f626a656374::i;526567457870::i;5265706c616365::i;5368656c6c::i;0/\(\s*[\x22\x27]c(?P<var>[a-zA-Z0-9]{5})m\1d\1\s*\1\/\1C\1\s*\1p\1o\1w\1e\1r\1s\1h\1e\1l\1l\1\.\1e\1x\1e\1\s*/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.FXIWTULA.M2;Target:2;(0&1&2&3&4&5&6);466f72::i;586f72::i;2349662057696e3634205468656e::i;55426f756e64::i;5543617365::i;4d6964::i;0/For\s+(?P<var>[a-z]{5,20})\s*=\s*\d{1,3}\s*To\s*[a-z]{5,20}\s+Select\s+Case\s*(?P=var)\s+Case\s*\d{1,3}\s*To\s*\d{1,3}\s+(?P<var2>[a-z]{5,20})\s*\(\s*(?P=var)\s*\)\s*=\s*(?P=var)\s*[\+-]\s*\d{1,3}\s+Case\s*\d{1,3}\s*To\s*[a-z]{5,20}\s+(?P=var2)\s*\(\s*(?P=var)\s*\)\s*=\s*(?P=var)\s*[\+-]\s*\d{1,3}/si
MiscreantPunch.EvilMacro.WENDEFD;Target:2;(0&1&2&3<250&(4|5|6|7|8|9|10|11));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var>[A-Za-z0-9]{2,15})\s*As\s+(?:Integer|String)\s+(?P=var)\s*=\s*[0-9]{1,3}\s+If\s+(?P=var)\s*[<>=]\s*[0-9]{1,3}\s*Then\s+(?P=var)\s*=\s*[0-9]{1,3}\s+For\s*(?P=var)\s*=\s*[0-9]{1,3}\s*To\s*[0-9]{1,3}\s+(?P=var)\s*=\s*(?P=var)\s*[\+-]\s*[0-9]{1,3}\s+Next/ig;29203d20;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.EvilMacro.AVBCOCXASC;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14));4174747269627574652056425f::i;4372656174654f626a656374::i;436872::i;586f72::i;4172726179::i;537472436f6e76::i;4/Array\s*\(\s*(?:[0-9]{1,3}\s*,\s*)+/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AACOLECTM;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;4172726179::i;4372656174654f626a656374::i;2e4c616e6775616765::i;2e4576616c::i;436f6e74656e742e54657874203d20::i;4d7367426f782028224d6163726f73::i;1/Array\s*\(\s*([0-9]{4}\s*,\s*)+/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.INFO.PaFishMacro;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12));2250616669736820666f72204f6666696365204d6163726f207632::i;206279204a6f6520536563757269747922::i;636865636b526563656e74446f6373::i;7072696e744d73672022444554454354454422::i;7072696e744d736720224f4b22::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.XCEDCECWA;Target:2;(0&(1&2|15)&3&4&5&6&(7|8|9|10|11|12|13|14));4174747269627574652056425f::i;2d77696e646f772068696464656e::i;2d456e636f646564436f6d6d616e64::i;5368656c6c::i;456e446563727970744d5552::i;436872::i;586f72::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i;652d206e656464696820776f646e69772d::i
MiscreantPunch.EvilMacro.LACODAVB;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;44696d::i;4372656174654f626a656374::i;4172726179::i;4c656e::i;1/Dim\s+(?P<var>[A-Za-z0-9]{2,15})(?:\s*As\s+(?:Integer|String))?\s+(?P=var)\s*=\s*[0-9]{1,3}\s+If\s+(?P=var)\s*[<>=]\s*[0-9]{1,3}\s*Then\s+(?:(?P=var)\s*=\s*[0-9]{1,3}\s+For\s*(?P=var)\s*=\s*[0-9]{1,3}\s*To\s*[0-9]{1,3})?(?P=var)\s*=\s*(?P=var)\s*[\+-]\s*[0-9]{1,3}\s+(?:Next)?/ig
MiscreantPunch.EvilMacro.PShellDL.Gen.1;Target:2;(0&1&2&3&4&5);5368656c6c2022636d64202f632022202b20::i;284e65772d4f626a656374::i;2e446f776e6c6f616446696c65::i;25544d50255c::i;2e657865::i;53746172742d50726f63657373::i
MiscreantPunch.EvilMacro.FIWTUBUB;Target:2;(0&1&2&3&4&5&6&7);46756e6374696f6e::i;2349662057696e3634205468656e::i;55426f756e64::i;5543617365::i;4d6964::i;4c696220226b65726e656c33322220416c696173202252656d6f76654469726563746f72794122::i;4c696220226e74646c6c2220416c696173202252746c416c6c6f636174654865617022::i;0/Function\s+(?P<var>[a-z]+)\s*\(\s*(?P<var2>[a-z]+)\s*,\s*(?P<var3>[a-z]+)\s*\)\s+(?P=var)\s*=\s*(?P=var2)\s*And\s*(?P=var3)\s+End\s+Function/ig
MiscreantPunch.EvilMacro.SVMCCCA;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14));4174747269627574652056425f::i;4372656174654f626a656374::i;436872::i;43616c6c42794e616d65::i;76624d6574686f64::i;536574::i;5/Set\s+(?P<var>[A-Za-z0-9]{5,20})\s*=\s*CreateObject\s*\(\s*[^\)]+\s*\)\s+CallByName\s*(?P=var)\s*,\s*[A-Za-z0-9]{5,20}\s*\(\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27]\s*\)\s*,\s*[0-9]{1,3}/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.SuspiciousDoc.CrackedVersion.2;Target:2;(0&(1|2|3|4|5|6|7|8));5350656369616c6953542052655061636b::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.BVADALEP;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;44696d20::i;4172726179::i;4c616e6775616765::i;4576616c::i;2/Array\s*\((?:\s*[\x22\x27]\s*[0-9]{4}\s*[\x22\x27]\s*,)+/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.CEVBBTDL;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11));4174747269627574652056425f::i;43687228::i;5368656c6c::i;1/(?:Chr\s*\(\s*[0-9]{2,3}\s*\)\s*\+\s*){5,}/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.CACODAVB;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;44696d::i;4372656174654f626a656374::i;4172726179::i;436872::i;1/Dim\s+(?P<var>[a-z]{5,15})\s+(?P=var)\s*=\s*[0-9]{1,3}\s+If\s+(?P=var)\s*[<>=]\s*[0-9]{1,3}\s*Then\s+/si
MiscreantPunch.EvilMacro.BVACRCOP;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;5f436c69636b2829::i;2e52756e::i;4372656174654f626a656374::i;5075626c6963::i;4/Public\s+Function\s+(?P<var>[A-Za-z]{2,15})\s*\(\s*ByVal\s*(?P<var2>[A-Za-z]{2,15})\s*As\s+String\s*,\s*ByVal\s*(?P<var3>[A-Za-z]{2,15})\s*As\s+String\s*\)\s*As\s+Boolean\s+(?P=var)\s*=\s*\w+\s*\(\s*(?P=var2)\s*,\s*(?P=var3)\s*\)\s+End\s+Function/si
MiscreantPunch.EvilMacro.GODPAVB;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11));4174747269627574652056425f::i;4765744f626a656374::i;44696d::i;2/Dim\s+(?P<var>[A-Za-z0-9]{2,20})\s*\(\s*[0-9]{1,3}\s*\)\s*[^\r\n]+\s+((?P=var)\s*\(\s*[0-9]{1,3}\s*\)\s*=\s*[0-9]{1,3}\s+)+/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.ADSADPCCO;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;436872::i;4372656174654f626a656374::i;43616c6c42794e616d65::i;44696d::i;4/Dim\s+(?P<var>[A-Za-z0-9]{2,15})\s+(?P=var)\s*=\s*[0-9]{1,3}\s+If\s+(?P=var)\s*[<>=]*\s*[0-9]{1,3}\s*Then\s+(?:(?P=var)\s*=\s*(?P=var)\s*[\+-=]\s*[0-9]{1,3}\s+)?End\s+If/si
MiscreantPunch.EvilMacro.PSDL.AVBSC;Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;5368656c6c::i;636d64202f63::i;4e65772d4f626a656374::i;2e657865::i;25544d50255c::i
MiscreantPunch.EvilMacro.CSWSIG.M1;Target:2;(0&(1|(2&3&4&5&6&7))&8);4261736536344465636f6465537472696e67::i;64656372797074::i;5072696e74::i;4765744f626a656374::i;47657428::i;537061776e496e7374616e6365::i;53686f7757696e646f77203d2030::i;437265617465::i;0/((?P<var>[A-Za-z0-9]+)\s*=\s*(?P=var)\s*\+\s*[\x22\x27]\s*(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})\s*[\x22\x27]\s+){10,}/sig
MiscreantPunch.EvilMacro.BVACRCOP.M2;Target:2;(0&1=2&2&3);4174747269627574652056425f::i;5f436c69636b2829::i;5075626c6963::i;2/Public\s+Function\s+(?P<var>[A-Za-z]{2,15})\s*\(\s*ByVal\s*(?P<var2>[A-Za-z]{2,15})\s*As\s+String\s*,\s*ByVal\s*(?P<var3>[A-Za-z]{2,15})\s*As\s+String\s*\)\s*As\s+Boolean\s+(?P=var)\s*=\s*\w+\s*\(\s*(?P=var2)\s*,\s*(?P=var3)\s*\)\s+End\s+Function/si
MiscreantPunch.EvilMacro.PSDL.ASMO;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;2d77696e646f772068696464656e::i;2d65204a4142::i;5368656c6c::i;706f7765727368656c6c2e657865::i;4d6963726f736f6674204f6666696365204572726f72::i;636f7272757074206f72206d697373696e67::i;51756974::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AOOOCGO;Target:2;(0&1&2&3&4&5&6&7&(9|10|11|12|13|14|15|16)&8);4174747269627574652056425f::i;6f626a574d4953657276696365::i;6f626a53746172747570::i;6f626a50726f63657373::i;6f626a436f6e666967::i;4765744f626a656374::i;537061776e496e7374616e6365::i;53686f7757696e646f77203d2030::i;0/((?P<var>[A-Za-z0-9]{2,20})\s*=\s*(?P=var)\s*\+\s*[\x22\x27]\s*[A-Za-z0-9!@#$%^&*]{32}\s*[\x22\x27]\s+){10,}/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.SRAVBDRL;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;53747252657665727365::i;4465636f64653634::i;5265706c616365::i;4c656e::i;537472436f6e76::i;7662556e69636f6465::i;1/(StrReverse\s*\(\s*[\x22\x27]\s*[A-Za-z0-9]{50,}[^\x22\x27]+\s*[\x22\x27]\s*\)\s*_\s+&\s*){5,}/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.USNFVBA;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var>[A-Za-z]{3,20})\s*As\s+Currency\s+(?P=var)\s*=\s*[0-9]{1,3}\s+If\s*(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,3}\s*Then\s+(?P=var)\s*=\s*[0-9]{1,3}\s+For\s*(?P=var)\s*=\s*[0-9]{1,3}\s*To\s*[0-9]{1,3}\s+(?P=var)\s*=\s*(?P=var)\s*[\+-<>=}{1,2}\s*[0-9]{1,3}/si;0/(?P<var2>[A-Za-z0-9]{3,20})\s*=\s*(?P=var2)\s*&\s*[\x22\x27]\s*(?:[0-9]{1,3}\w){100,}[0-9]{1,3}?\w?\s*[\x22\x27]/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.USNFVBA.M2;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var>[A-Za-z0-9]{3,20})\s*As\s+(?:Integer|Byte|String)\s*,\s*(?P<var3>[A-Za-z0-9]{3,20})\s*As\s*(?:Integer|Byte|String)\s+For\s*(?P=var)\s*=\s*[0-9]{1,3}\s*To\s*[0-9]{1,3}\s+(?P=var3)\s*=\s*(?P=var3)\s*[\+<>=-]{1,2}\s*(?P=var)\s+Next/si;0/(?P<var2>[A-Za-z0-9]{3,20})\s*=\s*(?P=var2)\s*&\s*[\x22\x27]\s*(?:[^\r\n]?[0-9]{1,3}[^\r\n]){40,}[0-9]{1,3}?\w?\s*[\x22\x27]/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.AOVBDP.M2;Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[A-Za-z[0-9]{3,20})\s*,\s*(?P<var2>[A-Za-z0-9]{3,20})\s+(?P=var)\s*=\s*[0-9]{1,3}\s+(?P=var2)\s*=\s*[0-9]{1,3}\s+If\s*(?P=var)\s*[<>=]{1,2}\s*(?P=var2)\s*Then/ig;4372656174654f626a656374::i;52756e::i;416374697665446f63756d656e742e53617665::i;416374697665446f63756d656e742e50617373776f7264::i
MiscreantPunch.EvilMacro.AOVBDP;Target:2;(0&1&2&(3|4|5|6|7|8|9|10));4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[A-Za-z[0-9]{3,20})\s*,\s*(?P<var2>[A-Za-z0-9]{3,20})\s+(?P=var)\s*=\s*[0-9]{1,3}\s+(?P=var2)\s*=\s*[0-9]{1,3}\s+If\s*(?P=var)\s*[<>=]{1,2}\s*(?P=var2)\s*Then/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.PonyDoc.161102;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&(12|13|14|15|16|17|18|19));4174747269627574652056425f::i;44696d::i;436f6e74726f6c54697054657874::i;234966205642413620416e642057696e3634205468656e::i;23456c73654966::i;57696e3332::i;23456c7365::i;4d6964::i;4c656674::i;5269676874::i;4c43617365::i;5543617365::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.SWF.FlashExploitGeneric;Target:11;(0&1&2&3);075061796c6f6164;0e436f70794241546f566563746f72;0646696e645650;0643616c6c5650
MiscreantPunch.SWF.FlashExploitGeneric.2;Target:11;(0&1&2);074558505f747279;09476574416464725630;07436c65616e5570
MiscreantPunch.SWF.FlashExploit.Generic.3;Target:11;(0&1&2&3);0646696e645650;0747657441646472;075061796c6f6164;0E436f70794241546f566563746f72
MiscreantPunch.SWF.SednitEK.11032016;Target:11;(0&1&2&3&4&5);0a67657442414164647235;0e6765744275666665724164647235;056d796f626a;0a496e69746961746f7233;0e6f626a656374456e636f64696e67;057461696e74
MiscreantPunch.SWF.EvilFlashRedir.11072016;Target:11;(0&1&2&3&4&5&6&7&8&9&10);0E496e6974456e636f726543686172;0E496e69744465636f646543686172;0741637469766558;05586f723634;064c6f61646572;0A55524c52657175657374;086164644368696c64;0C4361706162696c6974696573;0A706c6179657254797065;03786f72;06426173653634
MiscreantPunch.SWF.Neutrino.12072016;Target:11;(0&1&2&3&4&5&6);a025ff01a874*2401a025ff01a874;ff15????0000010000000000;11656e7465724672616d6548616e646c6572;056279746573;0D7365745f6f6c645265636f7264;096c6f61644279746573;0A63686172436f64654174
MiscreantPunch.SWF.Neutrino.12162016;Target:11;(0&1&2&3&4&5&6&7);096c6f61644279746573;044d61696e;086164644368696c64;0A63686172436f64654174;465753????????????????????????????00??0100;a025ff01a866??aa61??(d0|d1|d2|d3|62??)759174;a0(d0|d1|d2|d3|62??)(d0|d1|d2|d3|62??)(d0|d1|d2|d3|62??)66??a446????a025ff01a874(d4|d5|d6|d7|63??)(d0|d1|d2|d3|62??)(d0|d1|d2|d3|62??);ff15??????????0000000000
MiscreantPunch.SWF.Neutrino.01072017;Target:11;(0&1&2&3&4&5&6);096c6f61644279746573;044d61696e;086164644368696c64;0A63686172436f64654174;a025ff01a866{1-2}aa61{1-2}(d0|d1|d2|d3|62??)759174;a0(d0|d1|d2|d3|62??)(d0|d1|d2|d3|62??)(d0|d1|d2|d3|62??)66(????|??)a446{2-3}a025ff01a874(d4|d5|d6|d7|63??)(d0|d1|d2|d3|62??)(d0|d1|d2|d3|62??);ff15??????????0000000000
MiscreantPunch.SWF.NeutrinoDecode.01102017;Target:11;(0&1);0C257061796c6f616455726c25;0F257061796c6f61645263344b657925
MiscreantPunch.EvilMacro.iSpyDL.161103;Target:2;(0&1&2&3&4);4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var>[A-Za-z]{3,20})\s*,\s*(?P<var2>[A-Za-z]{3,20})\s+(?P=var)\s*=\s*[0-9]{1,3}\s+(?P=var2)\s*=\s*[0-9]{1,3}\s+If\s*(?P=var)\s*[<>=]{1,2}\s*(?P=var2)\s*Then/si;4372656174654f626a656374::i;2e52756e::i
MiscreantPunch.EvilMacro.PSDLB64.CSDR;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;43616c6c205368656c6c::i;5265706c61636528::i;537472436f6e76::i;766246726f6d556e69636f6465::i;526544696d::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.H1N1.161103;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));537472436f6e76::i;766246726f6d556e69636f6465::i;586f72::i;7662556e69636f6465::i;53747252657665727365::i;5363726f6c6c416374696f6e4e6f4368616e6765::i;5363726f6c6c416374696f6e456e64::i;456e64204966::i;7/End\s+If\s+(?P<var>[A-Za-z]{3,20})\s*=\s*(?:Sin|Cos|Tan)\s*\(\s*[0-9]{1,3}\s*\)\s+If\s*(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,3}\s*Then/ig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.EGOISR.161103;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14));4174747269627574652056425f::i;456e7669726f6e::i;4765744f626a656374::i;496e537472526576::i;2e52756e::i;4d7367426f78::i;0/(?P<var>[A-Za-z0-9]{1,20})\s*=\s*(?P=var)\s*\+\s*[\x22\x27]\s*[^\r\n]+\s*[\x22\x27]\s+(?:(?P=var)\s*=\s*(?P=var)\s*\+\s*[\x22\x27]\s*[^\r\n]+\s*[\x22\x27]\s+)+/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.CBNAVBCOF.161107;Target:2;(0&1&2&3);4174747269627574652056425f::i;43616c6c42794e616d65::i;46756e6374696f6e::i;2/Function\s*(?P<var>[A-Za-z]{3,20})\s*\(\s*\)\s*As\s+String\s+(?P=var)\s*=\s*\w\s*\(\s*[\x22\x27]?\s*?[0-9]{1,3}\s*?[\x22\x27]?(?:\s*,\s*[0-9]{1,3})?\s*,\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27](?:\s*,\s*)?(?:[\x22\x27]\s*[0-9]{1,3}\s*[\x22\x27]\s*)?\)\s+End\s+Function/si
MiscreantPunch.EvilMacro.TrickLoad.161108;Target:2;(0&1&2&3&4&5&6&7&8);4174747269627574652056425f::i;537562::i;25544d50255c::i;2e65786522::i;2f6320::i;5368656c6c::i;46696c654e616d65;2e706e6727::i;2e4c6162656c::i
MiscreantPunch.EvilMacro.MultiDL.161109;Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;496e537472::i;4c656e::i;4d6964::i;4372656174654f626a656374::i;417320446f75626c65::i;44696d::i;6/Dim\s+(?P<var>[A-Za-z]{2,20})\s*As\s+Double\s+(?P=var)\s*=\s*[0-9]{1,3}\s+End\s+Function/si
MiscreantPunch.EvilMacro.ObfPSDL.161109;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;4368725728::i;5368656c6c::i;44696d::i;3/Dim\s*(?P<var>[A-Za-z0-9]{2,20})\s*As\s+String\s+.+(?P=var)\s*=\s*(?:ChrW\([0-9]{1,3}\)\s*&\s*)+/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.APT29.1;Target:2;(0&1&2&3&4&5&6&7&8);4174747269627574652056425f::i;446f63756d656e744265666f7265436c6f7365::i;4372656174654f626a656374::i;5368656c6c::i;4372656174655465787446696c65::i;5772697465::i;436c6f7365::i;4172726179::i;7/Array\s*\(\s*(?:(?:-?[0-9]{1,4}\s*,\s*)?\(-?[0-9]{1,4}\s*[+-]\s*-?[0-9]{1,4}\s*\)\s*,\s*)+/ig
MiscreantPunch.EvilMacro.APT29.2;Target:2;(0&1&2&3&4&5&6&7&8&9);4174747269627574652056425f::i;436872::i;5772697465::i;4372656174654f626a656374::i;5368656c6c::i;4372656174655465787446696c65::i;53706c6974::i;45786563::i;4172726179::i;8/Array\s*\(\s*(?:&H[A-F0-9]{1,2}\s*,\s*)+/ig
MiscreantPunch.EvilMacro.PSDLB64.SDRS;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));4174747269627574652056425f::i;5368656c6c::i;4465636f64653634::i;5265706c61636528::i;537472436f6e76::i;766246726f6d556e69636f6465::i;526544696d::i;44696d::i;7/Dim\s+(?P<var>[a-z0-9]+)\s+As\s+String\s+(?P=var)\s*=\s*Decode64\s*\(\s*\w+\s*\(\s*(\x22|\x27)\s*(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.PonyDoc.161110;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));44696d::i;436f6e74726f6c54697054657874::i;234966205642413620416e642057696e3634205468656e::i;23456c73654966::i;57696e3332::i;23456c7365::i;4d6964::i;5269676874::i;4c43617365::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.B64DL.161110;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18));4174747269627574652056425f::i;4c696220227368656c6c33322220416c69617320225368656c6c457865637574654122::i;4c656e::i;4b696c6c::i;44697224::i;5072696e74::i;436c6f7365::i;4765744f626a656374::i;457865635175657279::i;57696e33325f50726f63657373::i;436f756e74203c3e2030::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.HMTL.VBScriptHTMLDLr;Target:3;(0&1&2&3&4&5&6);4372656174654f626a656374::i;53617665546f46696c65::i;526573706f6e7365426f6479::i;4372656174654f626a656374::i;5368656c6c45786563757465::i;436872::i;5/(?=.*?Chr\(\s*(?:67|99)\s*\))(?=.*?Chr\s*\(\s*(?:77|109)\s*\)).*?Chr\s*\(\s*(?:100|68)\s*\)/si
MiscreantPunch.EvilMacro.XF.Sic;Target:2;(0&1&2);416e20457863656c20466f726d756c61204d6163726f205669727573202858462e436c617373696329::i;57697468204c6f7264204e61746173::i;506f707079::i
MiscreantPunch.EvilMacro.Ursnif.161111;Target:2;(0&1&2&3&4&5&6&7);44696d::i;2e4c616e6775616765::i;4372656174654f626a656374::i;2e4c616e6775616765::i;2e416464436f6465::i;2e52756e::i;536574::i;6/Set\s+(?P<var>[a-zA-Z0-9]{3,20})\s*=\s*CreateObject\s*\(\s*[^\)]+\)\s+(?P=var)\s*\.\s*Language\s*=\s*[A-Za-z0-9]{3,20}\s+(?P=var)\s*\.\s*AddCode\s*\(\s*(?:[A-Za-z0-9]{3,20}\s*&\s*)+[A-Za-z0-9]{3,20}\s*\)\s+(?P=var)\s*\.\s*Run/si
MiscreantPunch.EvilMacro.PSDLB64.161111;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var>[A-Za-z0-9]{3,20})\s+(?P=var)\s*=\s*[\x22\x27]\s*-window hidden\s*-e\s*(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{7})\s*[\x22\x27]\s*_\s+&\s*[\x22\x27]\s*(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{8})\s*[\x22\x27]\s*_\s+/si;2d77696e646f772068696464656e::i;2d65204a4142::i;5368656c6c::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.Zloader.161115;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;436872::i;4372656174654f626a656374::i;44696d::i;3/Dim\s+(?P<var>[A-Za-z0-9]{3,20})\s*\x3a\s+(?:(?P=var)\s*=\s*(?P=var)\s*&\s*(?P<var2>[A-Za-z0-9]{3,20})\s*\(\s*[\x22\x27][A-Za-z0-9]{100,}\s*[\x22\x27]\s*\)\s*\x3a\s+)+/si;536372697074436f6e74726f6c::i;2e4c616e6775616765::i;2e4576616c::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.CBNAVBCOF.M2.161115;Target:2;(0&1&2&3&4);4174747269627574652056425f::i;43616c6c42794e616d65::i;4765744f626a656374::i;46756e6374696f6e::i;3/Function\s*(?P<var>[A-Za-z]{3,20})\s*\(\s*\)\s*As\s+String\s+(?P=var)\s*=\s*\w\s*\(\s*[\x22\x27]?\s*?[0-9]{1,3}\s*?[\x22\x27]?(?:\s*,\s*[0-9]{1,3})?\s*,\s*[\x22\x27]\s*[^\x22\x27]+\s*[\x22\x27](?:\s*,\s*)?(?:[0-9]{1,3})?(?:[\x22\x27]\s*[0-9]{1,3}\s*[\x22\x27]\s*)?\)\s+End\s+Function/si
MiscreantPunch.EvilMacro.PonyDoc.161115;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));4174747269627574652056425f::i;44696d::i;234966205642413620416e642057696e3634205468656e::i;23456c73654966::i;57696e3332::i;23456c7365::i;4d6964::i;5269676874::i;4c43617365::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.MultiDL.161115;Engine:81-255,Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;4c656e::i;4d6964::i;496e537472526576::i;4372656174654f626a656374::i;2e52756e::i;4/CreateObject\s*\(\s*[\x22\x27]\s*W(?!script\.shell)(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?s(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?c(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?r(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?i(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?p(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?t(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?\.(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?S(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?h(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?e(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?l(?:[\x22\x27]\s*[&+]\s*[\x22\x27])?l\s*[\x22\x27]\s*\)/si
MiscreantPunch.EvilMacro.JSNemucod.161118;Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17));4174747269627574652056425f::i;4372656174654f626a656374::i;46696c6553797374656d4f626a656374::i;4372656174655465787446696c65::i;4765745370656369616c466f6c646572::i;5772697465::i;57536372697074::i;436c6f7365::i;5368656c6c::i;41444f4442::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.PonyDoc.161122;Target:2;(0&1&2&3&4&5&6&7);4c696220226e74646c6c2e646c6c2220416c696173202252746c4d6f76654d656d6f727922::i;4c696220226e74646c6c2220416c69617320225a77416c6c6f636174655669727475616c4d656d6f727922::i;234966205642413620416e642057696e3634205468656e::i;44696d::i;23456c7365::i;4d6964::i;4c43617365::i;526f756e64::i
MiscreantPunch.EvilMacro.CerberDoc.161122;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15));4174747269627574652056425f::i;203d20::i;1/(?:Array\s*\(\s*(?:[\x22\x27].{1,7}[\x22\x27]\s*,\s*){3,}[\x22\x27].{1,7}[\x22\x27]\s*\)\s*\([0-9]{1,3}\s*\)(?:\s*&\s*)?)+/sig;4172726179::i;536574::i;4372656174654f626a656374::i;2e4c616e6775616765::i;2e4576616c::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.161122;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;0/(?P<var>[a-z]{8})\s*=\s*(?P<var2>[A-Za-z]{3,20})\s*\.\s*TextBox\d\s*&\s*[\x22\x27][^[x\22\x27][\x22\x27]\s+(?P<var3>[a-z]{8})\s*=\s*(?:[\x22\x27][^[x\22\x27][\x22\x27](?:\s*&\s*)?)+\s+(?P<var4>[a-z]{8})\s*=\s*(?:[\x22\x27][^[x\22\x27][\x22\x27](?:\s*&\s*)?)+\s+(?P<var5>[a-z]{8})\s*=\s*(?:[\x22\x27][^[x\22\x27][\x22\x27](?:\s*&\s*)?)+\s+(?P=var2)\s*\.\s*TextBox\d\s*&\s*[\x22\x27][^[x\22\x27][\x22\x27]\s+[a-z]{8}\s*=\s*(?P=var)\s*\+\s*(?P=var3)\s*\+\s*(?P=var4)\s*\+\s*(?P=var5)/sig;4372656174654f626a656374::i;536574::i;2e52756e::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.UnkDL.161123;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12));4372656174654f626a656374::i;7972616e6f69746369442e676e69747069726353::i;4a6f696e::i;43616c6c42794e616d6556624d6574686f64::i;5069636173736f::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.UnkPSDL.161123;Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;537562::i;2e43617074696f6e::i;6e65774e616d65::i;5368656c6c::i;0/[A-Za-z0-9]{2,15}\s*=\s*(?:[\x22\x27][^\r\n]+[\x22\x27](?:\s*\+\s*)?)\s+[A-Za-z0-9]{2,15}\s*=\s*(?:[\x22\x27][^\r\n]+[\x22\x27](?:\s*\+\s*)?)\s+/sig;2225544d22::i
MiscreantPunch.EvilMacro.MultiPSDL.161123;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14));4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[a-z]{3,20})\s+(?P=var)\s*=\s*#[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}#/si;43617365::i;4372656174654f626a656374::i;466f6c646572457869737473::i;5368656c6c::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.PonyDoc.161123;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20));4174747269627574652056425f::i;5265706c616365::i;4c5472696d::i;525472696d::i;2349662057696e3634205468656e::i;23456c7365::i;5472696d::i;5269676874::i;4c43617365::i;23456c736549662057696e3332205468656e::i;234966205642413620416e642057696e3634205468656e::i;23456e64204966::i;0/(?P<var>[a-z]{3,20})\s*=\s*[0-9]{1,3}\s+(?P<var2>[a-z]{3,20})\s*=\s*[0-9]{1,3}\s+If\s+\(\s*(?P=var)\s*\/\s*(?P=var2)\s*\)\s*[><=]{1,2}\s*[0-9]{1,3}\s*Then/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.GootkitDoc.161123;Target:2;(0&1&2>8&3&4&5&6&7&8&(9|10|11|12|13|14|15|16));4174747269627574652056425f::i;4765744f626a656374::i;43616c6c42794e616d65::i;2e537461747573::i;2e526573706f6e7365426f6479::i;4d7367426f78::i;76624f4b4f6e6c79::i;4d6964::i;417363::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.MultiDL.161128;Target:2;(0&1&2&3&4&5);5075626c69632046756e6374696f6e::i;496e537472526576::i;496e6c696e65536861706573::i;5368656c6c::i;456e64204966::i;0/(?:(?P<var>[a-z]{3,20})\s*=\s*[0-9]{1,3}\s+If\s*(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,3}\s*Then\s+(?:(?P=var)\s*=\s*(?P=var)\s*[\*\+\-\\]\s*[0-9]{1,3}\s+)?End If|If\s+[0-9]{1,3}\s*[<>=]{1,2}\s*[0-9]{1,3}\s*Then\s+[a-z]{5,25}\s*=\s*[0-9]{1,3}\s*[\+-=\/]\s*[0-9]{1,3}\s+End\sIf)/sig
#MiscreantPunch.EvilMacro.CommonDL.161128;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18));4174747269627574652056425f::i;4372656174654f626a656374::i;4d53584d4c322e584d4c48545450::i;43616c6c::i;4f70656e::i;2e53656e64::i;46696c6553797374656d4f626a656374::i;4372656174655465787446696c65::i;526573706f6e736554657874::i;5772697465::i;436c6f7365::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.161128;Target:2;(0&1&2&3>20&4&(5|6|7|8|9|10|11|12));4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[a-z]{3,20})\s+(?P=var)\s*=\s*#[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}#(?:\s+Dim\s*(?P<var2>[a-z]{3,20})\s+(?P=var2)\s*=\s*#[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}#)?/si;43617365::i;5368656c6c::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.PhishTest.161128;Target:2;(0&1&(2|3|4|5|6|7|8|9));4174747269627574652056425f::i;75726c203d2075726c202b2022267361743d776f72645f6d6163726f22::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.MultiDL.161129;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&(12|13|14|15|16|17|18|19));4174747269627574652056425f::i;5265706c616365::i;4372656174654f626a656374::i;2349662057696e3634205468656e::i;43617365::i;436c6f7365::i;43726561746557696e646f77::i;65786563536372697074::i;66696c65657869737473::i;4c616e6775616765::i;4164644f626a656374::i;2e52756e::i;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.MultiDL.161121;Target:2;(0&1&2&3);5075626c69632046756e6374696f6e::i;5368656c6c::i;456e64204966::i;0/(?:(?P<var>[a-z]{3,20})\s*=\s*[0-9]{1,3}\s+If\s*(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,3}\s*Then\s+(?:(?P=var)\s*=\s*(?P=var)\s*[\*\+\-\\]\s*[0-9]{1,3}\s+)?End If|If\s+[0-9]{1,3}\s*[<>=]{1,2}\s*[0-9]{1,3}\s*Then\s+[a-z]{5,25}\s*=\s*(?:[\x22\x27]\s*[a-z]{3,25}\s*[\x22\x27]\s+End\s+If|[0-9]{1,3}\s*[\+-=\/]\s*[0-9]{1,3}\s+End\sIf))/sig
MiscreantPunch.EvilMacro.UnkDL.161130;Target:2;(0&1&2&(3|4|5|6|7|8|9|10));4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[A-Za-z0-9]+)\s+Select\s+Case\s+[0-9]{1,3}\s+(?:Case\s+[0-9]{1,3}\s+(?P=var)\s*=\s*[0-9]{1,3}\s*[\*\+\-\\]\s*[0-9]{1,3}\s+)+Case\s+Else\s+(?P=var)\s*=\s*[0-9]{1,3}\s*(?:[\*\+\-\\]\s*[0-9]{1,3}\s*){1,3}\s+End\s+Select/si;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.MultiDL.161201;Target:2;(0&1&2&3&4);4174747269627574652056425f::i;5075626c69632046756e6374696f6e::i;44696d::i;5368656c6c::i;0/(?P<var>[a-z]{3,20})\s*=\s*[0-9]{1,3}\s+If\s+(?P=var)\s*[\-\+\\\*]\s*[0-9]{1,3}\s*Then\s+(?P<var2>[a-z]{3,20})\s*=\s*[\x22\x27]\s*[a-z]{3,20}\s*[\x22\x27]\s+(?P=var2)\s*=\s*[0-9]{1,3}\s+End\s+If/sig
MiscreantPunch.SWF.Sednit/Sofacy/APT28 CVE-2016-4117;Target:11;(0&1&2&3&4&5&6&7&8);1C44656c65746552616e676554696d656c696e654f7065726174696f6e::i;06393039303930::i;034d4143::i;0367696d::i;027368::i;026869::i;036c6f77::i;023078::i;5b5c735c725c6e5d
MiscreantPunch.EvilMacro.PSDL.161205;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s+(?P<var>[a-z]{2,20})\s*\([^\r\n]*\)\s+(?P<var2>[a-z]{2,20})\s*=\s*[\x22\x27][^\r\n]+[\x22\x27]\s+(?P=var)\s*=\s*(?P=var2)\s+End\s+Function/ig;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CerberPSDL.161205;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));2e54657874::i;5368656c6c::i;636d642e657865::i;65786974::i;2/(?:-\s*n(?:\^\s*)*?o(?:\^\s*)*?p(?:\^\s*)*?r(?:\^\s*)?o(?:\^\s*)?f(?:\^\s*)?i(?:\^\s*)?l(?:\^\s*)?e|-\s*w(?:\^\s*)*?i(?:\^\s*)*?n(?:\^\s*)*?d(?:\^\s*)*?o(?:\^\s*)*?w(?:\^\s*)*?s(?:\^\s*)*?t(?:\^\s*)*?y(?:\^\s*)*?l(?:\^\s*)*?e\^?\s*\^?h(?:\^\s*)*?i(?:\^\s*)*?d(?:\^\s*)*?d(?:\^\s*)*?e(?:\^\s*)*?n)/ig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PonyDoc.161206;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&(12|13|14|15|16|17|18|19));44696d::i;4c5472696d::i;525472696d::i;2349662057696e3634205468656e::i;23456c7365::i;5472696d::i;5269676874::i;4c43617365::i;23456c736549662057696e3332205468656e::i;234966205642413620416e642057696e3634205468656e::i;23456e64204966::i;0/(?P<var>[a-z]{3,20})\s*=\s*[0-9]{1,3}\s+(?P<var2>[a-z]{3,20})\s*=\s*[0-9]{1,3}\s+If\s+\(\s*(?P=var)\s*\/\s*(?P=var2)\s*\)\s*Then/sig;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
#MiscreantPunch.EvilMacro.MultiPSDL.161207;Target:2;(0&1&2&3&4&5&6&7);5075626c69632046756e6374696f6e::i;496e537472526576::i;536574::i;4372656174654f626a656374::i;5368656c6c::i;5368656c6c45786563757465::i;636d642e657865::i;4f70656e::i
MiscreantPunch.UnkPSDL.161207;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;5265706c616365::i;5368656c6c::i;457863656c20697320756e61626c6520746f20636f6e74696e7565::i;437269746963616c206572726f72::i;4d7367426f78::i;4170706c69636174696f6e2e51756974::i;2d656e63::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.VBSDL.161208;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;45786563757465::i;436f6d6d616e64427574746f6e315f436c69636b2829::i;4f70656e::i;5265706c616365::i;436c6f7365::i;77736372697074::i;536574::i;73617665546f46696c65::i;44656c65746546696c65::i;5072696e74::i;436872::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.161208;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4170706c69636174696f6e2e446f63756d656e74732e436f756e74203e2030::i;5368656c6c::i;766248696465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.161212;Target:2;(0&1&2&(3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22));5368656c6c::i;4170706c69636174696f6e2e446f63756d656e74732e436f756e74203e2030::i;0/(?P<var>[a-z0-9]{3,20})\s*=\s*(?:[a-z0-9]{3,20}(?:\s*&\s*)?){40,}\s+(?:[a-z0-9]{3,20}\s*=\s*(?:[a-z0-9]{3,20}(?:\s*&\s*)?){10,}\s+)?If\s*[a-z0-9]{3,20}\s*Then\s+Shell\s*(?P=var)/sig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.MultiPSDL.M2.161212;Target:2;(0&1&2&3&4&5&6&7&8);4c656e::i;4d6964::i;5075626c69632046756e6374696f6e::i;4372656174654f626a656374::i;7368656c6c2e6170706c69636174696f6e::i;5368656c6c45786563757465::i;636d642e657865::i;6f70656e::i;456e64204966::i
MiscreantPunch.EvilMacro.DridexDoc.161212;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));5368656c6c::i;54657874426f78::i;4174747269627574652056425f::i;0/Shell\s*(?P<var2>[a-zA-Z]{3,20})\s*\.\s*TextBox\d\s*&\s*(?P=var2)\s*\.\s*TextBox\d\s*&\s*/ig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.161214;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));5368656c6c::i;54657874426f78::i;4174747269627574652056425f::i;0/[a-z]{3,20}\s*=\s*(?P<var>[a-zA-Z]{3,20})\s*\.\s*TextBox\d\s+[a-z]{3,20}\s*=\s*(?P=var)\s*\.\s*TextBox\d/sig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.161215;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;4170706c69636174696f6e2e446f63756d656e74732e436f756e74::i;5368656c6c::i;766248696465::i;4172726179::i;0/(?P<var>[a-z0-9]{3,20})\s*=\s*(?:[a-z0-9]{3,20}(?:\s*&\s*)?){20,}\s+If\s*[a-z0-9]{3,20}\s*[<>=]{1,2}\s*[0-9]{1,2}\s*Then\s*Shell\s*(?P=var)\s*,\s*vbHide/sig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.161215;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;416374697665446f63756d656e742e456e76656c6f70652e44656661756c7453697a65::i;5368656c6c204a6f696e::i;4172726179::i;2/Shell\s+Join\s*\(\s*Array\s*\(\s*(?:[a-z0-9]{3,20}(?:\s*,\s*)?){10,}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.161219;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;54657874426f78::i;5368656c6c::i;0/[a-z]{3,20}\s*=\s*(?P<var>[a-zA-Z]{3,20})\s*\.\s*TextBox[0-9]\s*\+\s*(?P=var)\s*\.\s*TextBox[0-9]/sig::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.161219;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;5368656c6c204a6f696e::i;4172726179::i;1/Shell\s*Join\s*\(\s*Array\s*\(\s*(?:[a-z0-9]{3,20}(?:\s*,\s*)?)+/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.161220;Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;5075626c69632046756e6374696f6e::i;4c656e::i;53656c656374696f6e2e5479706554657874::i;766243724c66::i;5368656c6c::i;5/Shell\s*(?P<var>[a-z]{3,20})(?:\s*,\s*[0-9]{1,3})?\s+(?P=var)\s*=\s*[a-z0-9]{10,30}\s*\(\s*(?P=var)\s*\)\s+End\s*Sub/si
MiscreantPunch.EvilMacro.DridexDoc.161220;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4372656174654f626a656374::i;54657874426f78::i;52756e::i;0/CreateObject\s*\(\s*(?P<var>[A-Za-z0-9]{3,20})\s*\.TextBox[0-9]\s*\+\s*(?P=var)\s*\.\s*TextBox[0-9]\s*\+\s*(?P=var)\s*\.\s*TextBox[0-9]\s*\)\s*\.\s*Run/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.161222;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;5368656c6c::i;54657874426f78::i;0/[a-z]{3,20}\s*=\s*(?:((?:\x22[^\x22]+\x22)?(?:\s*\+\s*)?)+(?P<var>[A-Za-z0-9]{3,20})\s*\.\s*TextBox[0-9]\s+)((?:\x22[^\x22]+\x22)?(?:\s*\+\s*)?)+/sig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.161222;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4170706c69636174696f6e2e56657273696f6e::i;44696d::i;2/Dim\s*(?P<var>[a-z]{3,20})\s+(?P=var)\s*=\s*#[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{2,4}#/si;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MutliPSDL.161223;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;22746d70::i;416374697665446f63756d656e742e44656661756c745461626c655374796c65::i;5368656c6c::i;4966::i;4/If\s+[a-z]{3,20}\s+Then\s+Shell\s*[a-z]{3,20}\s*,\s*False/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.161227;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;416374697665446f63756d656e74::i;4966::i;5368656c6c::i;766248696465::i;2/If\s+[a-z]{3,20}\s*Then\s+Shell\s*[a-z]{3,20}\s*,\s*vbHide/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MutliPSDL.161227.M2;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;416374697665446f63756d656e742e44656661756c745461626c655374796c65::i;5368656c6c::i;4966::i;3/If\s+[a-z]{3,20}\s+Then\s+Shell\s*[a-z]{3,20}\s*,\s*False/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.161228;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4372656174654f626a656374::i;52756e::i;1/\s*\(\s*(?P<var>[a-z0-9]{3,20})\s*\.\s*TextBox[0-9]{1,2}\s*\+\s*(?:(?P=var)\s*\.\s*TextBox[0-9]{1,2}(?:\s*\+\s*)?)+\s*\)\s*\.\s*Run/si;54657874426f78::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiDL.161228;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;43617365::i;44696d::i;416374697665446f63756d656e742e::i;4a6f696e::i;4172726179::i;52756e::i;766248696465::i;2/Dim\s*(?P<var>[a-z]{3,20})\s+(?P=var)\s*=\s*\#[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{1,4}\#/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.161229;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4372656174654f626a656374::i;52756e::i;0/(?P<var>[a-z]{2,20})\s*=\s*(?P<var2>[a-z]{2,20})\s*\.\s*TextBox[0-9]{1,2}\s*\+\s*(?:(?P=var2)\s*\.\s*TextBox[0-9]{1,2}(?:\s*\+\s*)?)+\s+[a-z]{2,20}\s*=\s*CreateObject\s*\(\s*(?P=var)\s*\)\s*\.\s*Run/sig;54657874426f78::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.KelihosDoc.161229;Target:2;(0&1>50&2&3&4&5);4174747269627574652056425f::i;29202b2043687228::i;5368656c6c::i;4d6964::i;5075626c69632046756e6374696f6e::i;4/Public\s+Function\s+(?P<var>[A-Za-z0-9_-]{3,20})\s*\(\)\s*As\s+String\s+[^\r\n]+\s+(?P=var)\s*=\s*(?:Chr\([0-9]{1,3}\s*[\+\-]\s*[0-9]{1,3}\s*\)(?:\s*\+\s*)?)+/si
MiscreantPunch.EvilMacro.MultiDL.161230;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;43617365::i;44696d::i;416374697665446f63756d656e742e::i;4a6f696e::i;4172726179::i;52756e::i;2/Dim\s*(?P<var>[a-z]{3,20})\s+(?P=var)\s*=\s*\#[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{1,4}\#/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170103;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;5075626c69632046756e6374696f6e::i;4d6964::i;4372656174654f626a656374::i;52756e::i;496e6b50696374757265315f5061696e746564::i;4d53494e4b4155544c69622e49496e6b52656374616e676c65::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.161227;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4372656174654f626a656374::i;52756e::i;1/\s*\(\s*(?P<var>[a-z]{3,20})\s*\.\s*(?P<var2>[a-z]{3,20})[0-9]\s*\+\s*(?:(?P=var)\s*\.\s*(?P=var2)[0-9](?:\s*\+\s*)?)+\s*\)\s*\.\s*Run/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.JS.LockyDL.170104;Target:3;(0&1&2&3&4&5&6&7&8&9&10&11);4a536372697074::i;6576616c::i;72657475726e224d73786d6c322e584d4c48545450223b::i;72657475726e22687474703a2f2f223b::i;266d3d::i;6e6577416374697665584f626a65637428::i;6f70656e282247455422::i;7374617475733d3d323030::i;726573706f6e73655465787429::i;26693d::i;66756e6374696f6e::i;10/function[A-Za-z0-9_-]{1,20}\((?P<var>[A-Za-z0-9_-]{1,20})\)\{(?P=var)=(?P=var)\.(?:split|join)\([^\)]+\)\)?\x3b(?P=var)=(?P=var)\.(?:split|join)\([^\)]+\)\)?\x3beval\s*\((?P=var)\)/si
MiscreantPunch.EvilMacro.VBSDL.170105;Target:2;(0&1&2&3>10&4>10&5&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;404543484f::i;5368656c6c::i;2920262043687228::i;2e5642532026::i;4372656174654f626a656374::i;2e4f70656e::i;2e53656e64::i;2e5772697465::i;2e526573706f6e7365426f6479::i;2e53617665546f46696c65::i;2e436c6f7365::i;766248696465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170109;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;416374697665446f63756d656e742e44656661756c745461626c655374796c65::i;5368656c6c::i;0/[a-z]{3,20}\s*=\s*(?:[a-zA-Z]{1,4}(?:\s*\+\s*)?){12,}/sig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.TransparentTribeDoc.170109;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4170706c69636174696f6e2e557365724e616d65::i;41707044617461::i;526f616d696e67::i;4c656e::i;446972::i;4f70656e::i;44696d::i;7/Dim\s*[a-z]{1,2}\s*As\s+String\s+(?:Dim\s*[a-z]{1,2}\s+As\s+String(?:\s+)?){10,}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.INFO.PossibleMalDoc-macro_safe.py;Target:2;(0&(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20));47656e657261746564206279206d6163726f5f736166652e7079206279206b6872307834307368::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170109;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));5368656c6c::i;48657832537472::i;524334537472696e67::i;4d7367426f78::i;4170706c69636174696f6e2e51756974::i;766246726f6d556e69636f6465::i;43687224::i;4d696424::i;537472436f6e76::i;586f72::i;7662556e69636f6465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.HTA.EvilPSDL.170109;Target:2;(0&1&2&3&4&5&6&7);3c7363726970743e::i;766172::i;706f7765727368656c6c2e6578652d6e6f702d7374612d6e6f6e692d7768696464656e2d656e63::i;6e6577616374697665786f626a656374::i;777363726970742e7368656c6c::i;2e72756e28::i;73656c662e636c6f7365::i;1/var\s*(?P<var>[a-z]{1,20})\s*=\s*[\x22\x27]powershell\.exe-nop-sta-noni-whidden-enc[a-z0-9]{3,20}\s*[\x22\x27]\s*\+\s*(?:[\x22\x27]\s*[a-z0-9]{30,}\s*[\x22\x27](?:\s*\+\s*)?){10,}newactivexobject\s*\(\s*[\x22\x27]\s*wscript\.shell\s*[\x22\x27]\s*\)\s*\.run\s*\(\s*(?P=var)\s*\)/si
MiscreantPunch.EvilMacro.MultiPSDL.170110;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;43617365::i;53656c6563742043617365::i;4372656174654f626a656374::i;2e52756e::i;44696d::i;5/Dim\s+(?P<var>[a-z]{3,20})\s+(?P=var)\s*=\s*#[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{1,4}#/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170111;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4c6962202275726c6d6f6e2220416c696173::i;55524c446f776e6c6f6164546f46696c6541::i;57696e45786563::i;43617365::i;547970654e616d65::i;456e7669726f6e::i;46756e6374696f6e::i;7/Function\s*(?P<var>[a-z]{3,20})\s*\(\)\s+(?P=var)\s*=\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+End\s*Function/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.VBSDL.170111;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;5368656c6c::i;4f70656e::i;466f72204f7574707574204173::i;5072696e74::i;436c6f7365::i;4170706c69636174696f6e2e51756974::i;5265706c616365::i;575249544543454c4c4e554d424552574f524430::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170111;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));417474726962757465205642::i;46756e6374696f6e::i;1/Function\s*(?P<var>[a-z]{3,20})\s*\(\)\s+(?P=var)\s*=\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+End\s*Function/si;416374697665446f63756d656e742e::i;43617365::i;4a6f696e::i;4372656174654f626a656374::i;52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.MultiPSDL.170112;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;496e537472526576::i;4d6964::i;5368656c6c::i;4966::i;4/If\s*(?P<var>[a-z]{3,20})\s*[<>=]{1,2}\s*[0-9]{1,2}\s*Then.+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,2}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170113;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));456e7669726f6e::i;55524c446f776e6c6f6164546f46696c6541::i;46756e6374696f6e::i;2/Function\s*(?P<var>[a-z]{3,20})\s*\(\)\s+(?P=var)\s*=\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+End\s*Function\s+Function\s*(?P<var2>[a-z]{3,20})\s*\(\)\s+(?P=var2)\s*=\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+End\s*Function\s+Function\s*(?P<var3>[a-z]{3,20})\s*\(\)\s+(?P=var3)\s*=\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+End\s*Function/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilDoc.Hancitor.170113;Target:2;(0&1);4d5552414b414d49::i;01000000??00000002000000????????03000000????????04000000????????05000000????????06000000????????07000000????????08000000????????09000000????????12000000????????0A000000????????0C000000????????0D000000????????0E0000004?0100000F000000????????10000000????????13000000????????
MiscreantPunch.VBS.Implant.CobaltStrike;Target:0;(0&1&2&3&4);7375622052756e436f62616c74505331::i;705f626567436f62616c::i;4372656174654f626a656374::i;575363726970742e5368656c6c::i;2e52756e::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170113;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;52756e::i;4372656174654f626a656374::i;46756e6374696f6e::i;3/Function\s*(?P<var>[a-z]{3,20})\s*\(\)\s+(?P<var2>[a-z]{3,20})\s*=\s*[A-Za-z0-9]{1,20}\s+(?:(?P=var)\s*=\s*(?P=var2)\s+)?End\s*Function\s+Function\s*(?P<var3>[a-z]{3,20})\s*\(\)\s+(?P<var4>[a-z]{3,20})\s*=\s*[A-Za-z0-9]{1,20}\s+(?:(?P=var3)\s*=\s*(?P=var4)\s+)?End\s*Function/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.VeilPSDL.170113;Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;5265706c616365::i;4765744f626a656374::i;2e476574::i;2e537061776e496e7374616e6365::i;2e53686f7757696e646f77::i;2e437265617465::i;0/(?P<var>[A-Za-z0-9]{2,20})\s*=\s*[\x22\x27][^\r\n]+[\x22\x27]\s+(?:(?P=var)\s*=\s*(?P=var)\s*\+\s*[\x22\x27][^\r\n]+[\x22\x27](?:\s+)?){20,}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170116;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4372656174654f626a656374::i;43687228::i;3078::i;2e52756e::i;4d6964::i;586f72::i;203d2022::i;7/\s*=\s*\x22(?:0x[a-f0-9]{1,2}(?:,))+\x22\s*_\s+&\s+/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.JS.LockyDL.170116;Target:3;(0&1&2&3&4&5&6&7&8&9&10);3c736372697074206c616e67756167653d4a5363726970743e::i;4d73786d6c322e584d4c48545450::i;416374697665584f626a656374::i;6f70656e282247455422::i;22687474703a2f2f::i;2f3f613d::i;266d3d::i;26693d::i;726573706f6e7365546578742e73706c697428::i;766172::i;9/var(?P<var>[a-z]{1,5})\s*=\s*newactivexobject\([^\r\n]\)\x3b(?P=var)\.open\([\x22\x27]get[\x22\x27],[\x22\x27]http\x3a\x2f\x2f[^\r\n]+\/\?a=[A-Za-z0-9_]+&m=[0-9]+&i=[A-Za-z0-9_]+[\x22\x27],false\)\x3b(?P=var)\.send\(\)/si
MiscreantPunch.EvilMacro.UnkPSDL.170116;Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4372656174654f626a656374::i;76627363726970742e726567657870::i;5265706c616365::i;59656172284461746529::i;777363726970742e7368656c6c::i;2e52756e::i;44696d::i;7/Dim\s+(?P<var>[A-Za-z0-9_-]{3,20})\s+As\s+(?:Integer|Long|String)\s+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+If\s+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s*Then\s+End\s*If/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170117;Target:2;(0&1&2&3&4>500&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;496e537472526576::i;496e6b50696374757265315f5061696e746564::i;4d53494e4b4155544c69622e49496e6b52656374616e676c65::i;53656c656374696f6e2e5479706554657874::i;766243724c66::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170117;Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;2349662057696e3634205468656e::i;23456c7365::i;23456e64204966::i;55524c446f776e6c6f6164546f46696c6541::i;4372656174654f626a656374::i;2e52756e::i;4d7367426f78::i;656e61626c6520636f6e74656e74::i;53747252657665727365::i;456e7669726f6e::i;54454d50::i;5/CreateObject\s*\((?:Chr\s*\(\s*[0-9]{1,3}\s*\)(?:\s*\+\s*)?){10,}\s*\)/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170117;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;4172726179::i;5368656c6c::i;43617365::i;53656c6563742043617365::i;46756e6374696f6e::i;5/Function\s*(?P<var>[a-z]{3,20})\s*\(\)\s+(?P=var)\s*=\s*[\x22\x27]?[^\x22\x27]+[\x22\x27]?\s+End\s*Function\s+Function\s*(?P<var2>[a-z]{3,20})\s*\(\)\s+(?P=var2)\s*=\s*[\x22\x27]?[^\x22\x27]+[\x22\x27]?\s+End\s*Function\s+Function\s*(?P<var3>[a-z]{3,20})\s*\(\)\s+(?P=var3)\s*=\s*[\x22\x27]?[^\x22\x27]+[\x22\x27]?\s+End\s*Function/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.DridexDoc.170118;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4372656174654f626a65637428::i;2e52756e::i;0/[a-z]{8}\s*=\s*(?P<var>[A-Za-z]{3,20})\s*\.\s*[A-Za-z]{3,20}(?:\s*&\s*[\x22\x27][^\x22\x27]*[\x22\x27])?\s+(?:[a-z]{8}\s*=\s*(?P=var)\s*\.\s*[A-Za-z]{3,20}(?:\s*&\s*[\x22\x27][^\x22\x27]*[\x22\x27])?)+/sig;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CMStrDoc.170118;Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;416c6c557365727350726f66696c65::i;5265706c616365::i;4372656174654f626a6563742822577363726970742e5368656c6c2229::i;57696e646f77735c43757272656e7456657273696f6e5c52756e::i;72756e646c6c3332::i;466f722042696e6172792041732023::i;4f70656e::i;436c6f7365::i;786f7253656564::i;7265677772697465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CerberPSDL.170118;Engine:81-255,Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4172726179::i;5368656c6c::i;1/Array\s*\(\s*(?:(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]*[\x22\x27])(?:\s*,\s*)?){5,}\s*\)(?:\s*\([^\)]*\))\s+/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.BITSDL.170119;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;4f70656e::i;436872::i;456e7669726f6e::i;44696d::i;4/(?:Dim\s*[a-zA-Z]{15,35}\s*As\s*(?:String|Boolean|Long|Integer)(?:\s+)){10,}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170119;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;2d77696e646f772068696464656e202d65::i;5368656c6c::i;706f7765727368656c6c2e657865::i;437269746963616c204d6963726f736f6674204f6666696365204572726f72::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170120;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;55524c446f776e6c6f6164546f46696c6541::i;4c6962::i;43617365::i;46756e6374696f6e::i;4/Function\s*(?P<var>[a-z]{3,20})\s*\(\)\s+(?P=var)\s*=\s*[\x22\x27]?[^\x22\x27]+[\x22\x27]?\s+End\s*Function\s+Function\s*(?P<var2>[a-z]{3,20})\s*\(\)\s+(?P=var2)\s*=\s*[\x22\x27]?[^\x22\x27]+[\x22\x27]?\s+End\s*Function\s+Function\s*(?P<var3>[a-z]{3,20})\s*\(\)\s+(?P=var3)\s*=\s*[\x22\x27]?[^\x22\x27]+[\x22\x27]?\s+End\s*Function/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.SVG.HUER.Script.StringConcatToFunction;Target:3;(0&1&2&3&4&5&6&7);3c3f786d6c::i;3c737667::i;3c736372697074::i;5b6364617461::i;6e657766756e6374696f6e::i;3b7d766172::i;1/<svg(?:(?!<\/svg).)+?<script(?:(?!<\/script).)+?<\!\[cdata/i;5/\x3b\}var(?P<vname>[^\x3d]+)=\w+\(\)\+\w+\(\)\+\w+\(\)\+\w+\(\)\+\w+\(\)\+\w+\(\)\+\w+\(\)\+.+?newfunction\((?P=vname)\)\(\)(?:(?!<\/script).)*?<\/script>(?:(?!<\/svg).)*?<\/svg>/i
MiscreantPunch.INFO.LNK.CMDPSHELL;Target:0;(0&1);4c0000000114020000000000C000000000000046*636d642e657865::i;0/cmd\.exe.+?p\x00\^?\x00?o\x00\^?\x00?w\x00\^?\x00?e\x00\^?\x00?r\x00\^?\x00?s\x00\^?\x00?h\x00\^?\x00?e\x00\^?\x00?l\x00\^?\x00?l/si
#MiscreantPunch.INFO.LNK.PSHELL;Target:0;(0);4c0000000114020000000000C000000000000046*5c57696e646f7773506f7765727368656c6c5c76312e305c706f7765727368656c6c::i
MiscreantPunch.EvilMacro.PSDL.170121;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[A-Za-z]{3,20})\s*As\s*(?:Integer|Long|String)\s+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+If\s*(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s*Then\s+End\s*If/si;4372656174654f626a656374::i;76627363726970742e726567657870::i;2e52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170121;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;55524c446f776e6c6f6164546f46696c6541::i;4c6962::i;46756e6374696f6e::i;3/Function\s*(?P<var>[a-z]{2,20})\s*\(\)\s+(?P<var2>[a-z]{2,20})\s*[=<>]{1,2}\s*[\x22\x27]?[^\x22\x27]*[\x22\x27]?\s+(?P=var)\s*[=<>]{1,2}\s*(?P=var2)\s+End\s*Function/si;456e7669726f6e::i;57696e45786563::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.M2.170121;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;203d20::i;4372656174654f626a65637428::i;2e52756e::i;2829::i;4/\(\)\s+[a-z]{8}\s*=\s*(?P<var>[A-Za-z0-9]{3,20}\.[A-Za-z0-9]{3,20})\s+[a-z]{8}\s*=\s*(?:(?:[\x22\x27][^\x22\x27]*[\x22\x27])(?:\s*&\s*)?)+\s+[a-z]{8}\s*=\s*(?:(?:[\x22\x27][^\x22\x27]*[\x22\x27])(?:\s*&\s*)?(?P=var)?)+\s+[a-z]{8}\s*=\s*(?:[a-z]{8}(?:\s*\+\s*)?){2,}\s+/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.AOCOJRL.01232017;Engine:81-255,Target:2;(0=0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24)&25&26&27&28);777363726970742e7368656c6c::i;2e72756e::i;4a6f696e28::i;41736328::i;204c696b6520222a222026::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;1/\.run\s*\(?\s*\w+\s*,\s*\w{4,}/i;2/Join\s*\(\s*\w+\s*,\s*(?:\x22\x22|\x27\x27)\s*\)/i;3/Asc\(\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s*\)\s*[+-]\s*\d+/i;4372656174654f626a65637428::i
MiscreantPunch.EvilMacro.MultiPSDL.170121;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;53656c656374696f6e2e5479706554657874::i;4372656174654f626a65637428::i;4a6f696e28::i;2e52756e::i;44696d::i;5/Dim\s*(?P<var>[a-z]{3,25})\s*As\s*String\s+(?P=var)\s*=\s*[\x22\x27][^\x22\x27]*[\x22\x27]\s+Dim\s*(?P<var2>[a-z]{3,25})\s*As\s*Long\s+(?P=var2)\s*=\s*[0-9]{1,5}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.PSDL.170123;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;4372656174654f626a656374282276627363726970742e7265676578702229::i;2e5265706c61636528::i;2e52756e::i;44696d::i;4/Dim\s*(?P<var>[a-zA-Z]{3,30})\s*As\s*Integer\s+Dim\s*(?P<var2>[a-zA-Z]{3,30})\s*As\s*Integer\s+(?P=var)\s*=\s*[0-9]{1,5}\s+If\s*(?P=var)\s*[=<>]{1,2}\s*[0-9]{1,5}\s*Then\s+(?P=var2)\s*=\s*[0-9]{1,5}(?:\s*\+\s*[0-9]{1,5})?\s+End\s*If/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DDAYRND;Target:2;(0&1&2);44696d20646f6f6d64617920417320537472696e67::i;43616c6c205368656c6c2873747250726f6772616d4e616d65::i;496e7428526e642829202a204c656e::i
MiscreantPunch.EvilMacro.DECEXEINFRM;Target:2;(0&1);4d6963726f736f667420466f726d73*3737{0-20}3930*3834{0-20}313034;0/84(?P<split>.{0,20})104(?P=split)105(?P=split)115(?P=split)32(?P=split)112(?P=split)114(?P=split)111(?P=split)103(?P=split)114(?P=split)97(?P=split)109/s
MiscreantPunch.EvilMacro.STARTUPDRPR.M1;Target:2;(0&1&2&3&4);4174747269627574652056425f4e616d65::i;22433a22202620456e7669726f6e2822484f4d45504154482229202620225c417070446174615c526f616d696e675c4d6963726f736f66745c57696e646f77735c5374617274204d656e755c50726f6772616d735c537461727475705c{1-255}2e65786522::i;28735f6469726563746f727920417320537472696e67::i;4372656174654f626a6563742822536372697074696e672e46696c6553797374656d4f626a6563742229::i;66696c6545786973747328735f6469726563746f7279202620225c22202620735f66696c654e616d6529::i
MiscreantPunch.EvilMacro.PSHREVRSH.M1;Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));452d*6c6c6568737265776f70::i;5368656c6c::fi;53747252657665727365::fi;4174747269627574652056425f::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.SJEVBREXCOARSC;Target:2;(0&1&2&3&4&5&6);5368656c6c204a6f696e28::i;3d2023::i;3d20417272617928::i;53656c6563742043617365::i;0/Shell Join\x28\s*\w+\s*\,\s*(?:\x22\x22|\x27\x27)\s*\x29\s*,\s*vbHide/i;3/Select Case\s+\d{2}/i;1/= #\s*\d{1,2}\/\d{1,2}\/[12]\d{3}\s*#\s.+?= #\s*\d{1,2}\/\d{1,2}\/[12]\d{3}\s*#\s.+?= #\s*\d{1,2}\/\d{1,2}\/[12]\d{3}\s*#\s/s
MiscreantPunch.EvilDoc.Hancitor.170124;Target:2;(0&1);4641495247414d45::f;01000000??00000002000000????????03000000????????04000000????????05000000????????06000000????????07000000????????08000000????????09000000????????12000000????????0A000000????????0C000000????????0D000000????????0E0000004?0100000F000000????????10000000????????13000000????????
MiscreantPunch.EvilMacro.AOCOJRL.20170125;Target:2;(0=0&1&2&3>15&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));777363726970742e7368656c6c::i;4372656174654f626a656374::i;2e72756e::i;2220(2b|26)2022??2220(2b|26)2022;1/CreateObject\s*\(\s*[a-z0-9]+\s*\)\.run\s*\(\s*[a-z0-9]+\s*,\s*0\s*\)/i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Hancitor.170124.M2;Target:2;(0&1&2&3>10&(4|5|6|7|8)>5);4c696220226e74646c6c2e646c6c2220416c69617320224e74416c6c6f636174655669727475616c4d656d6f727922::i;4c696220225368656c6c33322e646c6c2220416c696173202253484765744465736b746f70466f6c64657222::i;4c6962202253686c776170692e646c6c2220416c6961732022534843726561746554687265616422::i;0a2720;203d20(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)20(2b|2a|2f|2d)20(31|32|33|34|35|36|37|38|39);203d20(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)20(2b|2a|2f|2d)20(31|32|33|34|35|36|37|38|39);203d20(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)20(2b|2a|2f|2d)20(31|32|33|34|35|36|37|38|39);203d20(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)(31|32|33|34|35|36|37|38|39)20(2b|2a|2f|2d)20(31|32|33|34|35|36|37|38|39);203d20(31|32|33|34|35|36|37|38|39)20(2b|2a|2f|2d)20(31|32|33|34|35|36|37|38|39)
#MiscreantPunch.SUSPICIOUS.NoWordsHasMacro;Target:2;(0&(1|2|3|4|5|6|7|8|9|10));01000000??00000002000000????????03000000????????04000000????????05000000????????06000000????????07000000????????08000000????????09000000????????12000000????????0A000000????????0C000000????????0D000000????????0E0000004?0100000F000000????????10000000????????13000000????????;4174747269627574652056425f::i;44696d::if;446f63756d656e745f4f70656e::i;446f63756d656e745f436c6f7365::i;576f726b73686565745f4f70656e::i;4175746f5f4f70656e::i;4175746f4f70656e::i;576f726b626f6f6b5f4f70656e::i;4175746f5f436c6f7365::i;4175746f436c6f7365::i
MiscreantPunch.EvilMacro.STARTUPDRPR.M2;Target:2;(0&1&2);4d6f64756c65312e4c2872::i;206529203d2030::i;72203d2022433a22202620456e7669726f6e2822484f4d45504154482229202620225c417070446174615c526f616d696e675c4d6963726f736f66745c57696e646f77735c5374617274204d656e755c50726f6772616d735c53746172747570::i
MiscreantPunch.EvilMacro.AOCOJRL.20170126;Target:2;(0=0&1&2&3>5&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));777363726970742e7368656c6c::i;4372656174654f626a656374::i;2e72756e::i;2220(2b|26)20225e22;1/CreateObject\s*\(\s*[a-z0-9]+\s*\)\.run\s*\(\s*[a-z0-9]+\s*,\s*0\s*\)/i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.LOCSKEYS;Target:2;(0=0&1&2&3);777363726970742e7368656c6c::i;206c6f6352616e646f6d697a6553656e646b657973::i;2e72756e::i;417474726962757465205642::i
MiscreantPunch.EvilMacro.AOCOCHCI.01262017;Target:2;(0=0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));777363726970742e7368656c6c::i;4372656174654f626a656374284368722843496e7428::i;2e52756e20284368722843496e7428::i;2e416464436f6465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.RBEINTSSTRC;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));54686973446f63756d656e74::i;5242797465456e6372797074::i;5368656c6c::i;496e7432537472::i;537472436f6e76::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.GOLONGRCRR;Target:2;(0=0&1&2&3&4&5>12&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));777363726970742e7368656c6c::i;4372656174654f626a656374::i;2e5265706c616365::i;4765744f626a656374::i;2e72756e::i;203d20(31|32|33|34|35|36|37|38|39);2/\.Replace\s*\(\s*[A-Z0-9a-z]+\s*,\s*(?:\x22\x22|\x27\x27)\s*\)/i;3/GetObject\s*\(\s*[A-Z0-9a-z]+\s*\(\s*(?P<q>[\x22\x27])(?:(?!(?P=q)).){50}/i;4/\.run\s*\w+\s*,\s*\w{2,}\s/i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.URLDLTFRNOWSHSPF;Engine:81-255,Target:2;(0=0&1&2&3&4&5&6&7);777363726970742e7368656c6c::i;75726c6d6f6e2220416c696173202255524c446f776e6c6f6164546f46696c65::i;4372656174654f626a656374::i;2e72756e::i;2e5370656369616c466f6c64657273::i;3d203120546f204c656e28{0-500}417363284d696428{0-500}43687228::i;2/CreateObject\(\s*\w+\s*\)\.run/i;3/CreateObject\(\s*\w+\s*\)\.SpecialFolders/i
MiscreantPunch.EvilMacro.B64NPSHMATH;Target:2;(0&1&2&3&4&5&6&7&8);4c696220227368656c6c33322220416c69617320225368656c6c457865637574654122::i;283020546f202832202a::i;2a203329205c2034::i;436c6f73652023::i;5072696e742023::i;44696d20::i;5/Dim\s+(?P<var1>\w+)\s+As\s+String.+?(?P=var1)\s*=\s*(?P<var2>\w+)\s*\(\s*(?:(?P=var2)\s*\()+[\x22\x27](?:[A-Za-z0-9+\x2f]{4})*(?:[A-Za-z0-9+\x2f]{2}==|[A-Za-z0-9+\x2f]{3}=)?[\x22\x27]/s;4/Print \#\s*\(\s*\d+\s*[*\/+-]/i;3/Close \#\s*\(\s*\d+\s*[*\/+-]/i
MiscreantPunch.EvilMacro.AOARRUNSTRCON;Target:2;(0=0&(1|2)>75&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));777363726970742e7368656c6c::i;202b20;202620;3d204172726179::i;4372656174654f626a656374::i;2e72756e::i;4/=\s*Array\s*\x28[^\r\n\x29]+\.run\s*\(\s*\w+\s*,/i;5/CreateObject\s*\(\s*\w+\s*\)/i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.AOARRUNSTRCON.M2;Target:2;(0>50&1&2&(3|4|5|6)>5&(7|8)>50&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));3d20417272617928::i;4174747269627574652056425f*(0a|20|0d|5b|2e)7368656c6c::i;1/\bShell\b(?:\]\$?|\$?\(\s*|\s+)[A-Za-z]/i;5e22;225e;5e27;275e;202620;202b20;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDECRYPTKEY;Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4372656174654f626a65637428::i;575363726970742e5368656c6c::i;2e537464496e2e57726974654c696e652064656372797074696f6e6b6579::i;706f7765727368656c6c2e657865::i;46756e6374696f6e2044656372797074::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.170130;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&(16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35));4174747269627574652056425f::i;436f6e7374::i;2e54657874426f78::i;203d20227022::i;203d20226f22::i;203d20227722::i;203d20226522::i;203d20227222::i;203d20227322::i;203d20226822::i;203d20226522::i;203d20226c22::i;203d20226c22::i;203d20227822::i;417272617928::i;5368656c6c28::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170130;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;5368656c6c2043687228::i;1/Shell\s*Chr\([0-9]{1,3}\s*-\s*[0-9]{1,3}\)\s*&\s*(?:Chr\([0-9]{1,3}\s*-\s*[0-9]{1,3}\)(?:\s*&\s*)?){8,}/si;4372656174654f626a656374::i;2e4f70656e::i;766248696465::i;53617665546f46696c65::i;2e73656e64::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170131;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16&17&18&19&20&21&22&23&24&25&26&27&28&29&30&31&32&(33|34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51|52));4174747269627574652056425f::i;2349662057696e3634205468656e::i;55524c446f776e6c6f6164546f46696c6541::i;4372656174654f626a656374::i;456e7669726f6e::i;4368722831313529::i;4368722831323129::i;4368722831313529::i;4368722831313629::i;4368722831303129::i;4368722831303929::i;43687228343629::i;43687228393929::i;4368722831313129::i;4368722831303829::i;4368722831303829::i;4368722831303129::i;43687228393929::i;4368722831313629::i;4368722831303529::i;4368722831313129::i;4368722831313029::i;4368722831313529::i;43687228343629::i;43687228393729::i;4368722831313429::i;4368722831313429::i;43687228393729::i;4368722831323129::i;4368722831303829::i;4368722831303529::i;4368722831313529::i;4368722831313629::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.M2.170131;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10);4174747269627574652056425f::i;203d20226322::i;203d20226d22::i;203d20226422::i;4372656174654f626a65637428::i;2e5368656c6c::i;4e65772d4f626a656374::i;2e52756e::i;2e657865::i;766248696465::i;0/[a-z]{3,9}\s*=\s*\x22c\x22\s+[a-z]{3,9}\s*=\s*\x22m\x22\s+[a-z]{3,9}\s*=\s*\x22d\x22/si
MiscreantPunch.EvilDoc.Hancitor.170131;Engine:81-255,Target:2;(0&(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20));87FFDA00080102000105007FFFDA00080103000105007FFFDA00080101000105007FFFDA0008010202063F007FFFDA0008010302063F007FFFDA0008010101063F007FFFD9434f4d4f444f;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.170201;Engine:81-255,Target:2;(0&1&(2|3)&(4|5)&(6|7)&(8|9)&(10|11)&12&13&14&15&(16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35));4174747269627574652056425f::i;436f6e7374::i;203d20227022::i;203d20226f22::i;203d20227722::i;203d20226522::i;203d20227222::i;203d20227322::i;203d20226822::i;203d20226522::i;203d20226c22::i;203d20226c22::i;203d20227822::i;417272617928::i;5368656c6c28::i;0/[A-Za-z]{12}\s*=\s*(?P<var>[a-zA-Z0-9]{3,20})\.(?P<var2>[A-Za-z0-9]{3,20})\s+(?:[A-Z]{12}\s*=\s*\x22[^\x22]*\x22\s+)+[A-Z]{12}\s*=\s*(?P=var)\.(?:(?P=var2)|(?P=var3))\s+(?:[A-Z]{12}\s*=\s*\x22[^\x22]*\x22\s+)+[A-Z]{12}\s*=\s*(?P=var)\.(?P<var3>[A-Za-z0-9]{3,20})\s+(?:[A-Z]{12}\s*=\s*\x22[^\x22]*\x22\s+)+/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.TurlaAPT.170202;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16&17&18&(19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35|36|37|38));4174747269627574652056425f::i;586f72::i;4b696c6c::i;4372656174654f626a656374::i;536372697074696e672e46696c6553797374656d4f626a656374::i;44656c65746546696c65::i;4f70656e::i;466f722042696e6172792041732023::i;537472436f6e76::i;4765742023::i;76627363726970742e726567657870::i;2e45786563757465::i;456e7669726f6e::i;61707064617461::i;57536372697074::i;5368656c6c::i;2e52756e::i;536574::i;17/Set\s*(?P<var>[A-Za-z0-9]{3,20})\s*=\s*CreateObject\s*\(\s*[\x22\x27]WScript\s*\.\s*Shell\s*[\x22\x27]\s*\)\s+(?P=var)\s*\.\s*Run/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.SWF.FlashExploit.Generic.170202;Engine:81-255,Target:11;(0&1&2&3&4&5);0B686578546f537472696e67::i;057368656c6c::i;084578705f44617461::i;064c6f61646572::i;086164644368696c64::i;ff15??????????0000000000
MiscreantPunch.XAP.SilverLightExploitGeneric.170202.1;Engine:81-255,Target:1;(0&1);3a5c55736572735c4b4b4b5c{0-500}2e706462::i;53696c7665726c69676874::i
MiscreantPunch.XAP.SilverLightExploitGeneric.170202.2;Engine:81-255,Target:1;(0&1&2);7368656c6c3332::iaw;53696c7665726c69676874::iaw;5368656c6c5f73697665722e646c6c::iaw
MiscreantPunch.EvilMacro.DridexDoc.170202;Engine:81-255,Target:2;(0&(1|2)&(3|4)&(5|6)&(7|8)&(9|10)&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;203d20227022::i;203d20226f22::i;203d20227722::i;203d20226522::i;203d20227222::i;203d20227322::i;203d20226822::i;203d20226522::i;203d20226c22::i;203d20226c22::i;203d20227822::i;0/[A-Za-z]{12}\s*=\s*(?P<var>[a-zA-Z0-9]{3,20})\.TextBox[0-9]\s+(?:[A-Z]{12}\s*=\s*\x22[^\x22]*\x22\s+)+[A-Z]{12}\s*=\s*(?P=var)\.TextBox[0-9]\s+(?:[A-Z]{12}\s*=\s*\x22[^\x22]*\x22\s+)+[A-Z]{12}\s*=\s*(?P=var)\.TextBox[0-9]\s+(?:[A-Z]{12}\s*=\s*\x22[^\x22]*\x22\s+)/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170203;Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[a-z]{10,30})\s*As\s*Long\s+(?P=var)\s*[=<>]{1,2}\s*[0-9]{1,4}\s+(?:[\x27\x22][a-z]+\s+)?Dim\s*(?P<var2>[a-z]{10,20})\s*As\s*Long\s+(?P=var2)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+(?:[\x27\x22][a-z]+\s+)?If\s*(?P=var)\s*[<>=]{1,2}\s*(?P=var2)\s*Then/si;766243724c66::i;4765744f626a656374::i;4a6f696e::i;2e52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170206;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&(14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33));4174747269627574652056425f::i;203d20227022::i;203d20226f22::i;203d20227722::i;203d20226522::i;203d20227222::i;203d20227322::i;203d20226822::i;203d20226522::i;203d20226c22::i;203d20226c22::i;203d20227822::i;5368656c6c::i;0/(?:[a-z]{3,20}\s*=\s*(?:[a-z]{3,20}(?:\s*&\s*)?){5,}\s+){5,}/s;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.DridexDoc.170206;Engine:81-255,Target:2;(0&(1|2)&(3|4)&(5|6)&(7|8)&(9|10)&11&12&13&14&(15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34));4174747269627574652056425f::i;203d20227022::i;203d20226f22::i;203d20227722::i;203d20226522::i;203d20227222::i;203d20227322::i;203d20226822::i;203d20226522::i;203d20226c22::i;203d20226c22::i;203d20227822::i;0/[A-Za-z]{12}\s*=\s*(?P<var>[a-zA-Z0-9]{3,20})\.TextBox[0-9]\s+(?:[A-Z-a-z]{12}\s*=\s*(?:(?:[A-Za-z]{12}(?:\s*\+\s*)?)+|[\x22\x27][^\x22\x27]*[\x22\x27]|(?P=var)\.TextBox[0-9])\s+){3,}/s;46756e6374696f6e::i;13/Function\s*[A-Z]{10,12}\s*\(\)\s+[A-Z]{10,20}\s*=\s*[\x22\x27](?P<var1>[A-Z]{10,15})[\x22\x27]\s+[A-Z]{10,20}\s*=\s*[\x22\x27](?P=var1)[\x22\x27]\s+[A-Z]{10,20}\s*=\s*[\x22\x27](?P=var1)[\x22\x27]/s;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170206;Engine:81-255,Target:2;(0&1&2&3&4);4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var>[a-z]{5,30})\s*As\s*(?:Double|String|Long)\s+(?:[\x27\x22][a-z]+\s+)?Dim\s*(?P<var2>[a-z]{5,30})\s*As\s*(?:Double|String|Long)\s+(?P=var)\s*[=<>]{1,2}\s*[0-9]{1,4}\s+(?:[\x27\x22][a-z]+\s+)?(?P=var2)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+(?:[\x27\x22][a-z]+\s+)?If\s*(?P=var)\s*[<>=]{1,2}\s*(?P=var2)\s*Then/si;4765744f626a656374284a6f696e28::i;2e52756e::i
MiscreantPunch.EvilMacro.MultiPSDL.M3.170206;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s*(?P<var>[a-z]{5,20})\s*\(\s*\)\s+(?P=var)\s*=\s*(?:[0-9]{1,4}|[\x22\x27][a-z]{3,20}[\x22\x27])\s+End\s*Function/si;53706c6974::i;5368656c6c::i;0/(?P<var>[a-z]{3,20})\s*=\s*[\x22\x27]\s*cm(?P<var2>[a-z]{2,4})D\.(?P=var2)(?:[\x20-\x7e]{1,5}(?P=var2)[\x20-\x7e]{1,5})+\s+[a-z]{2,15}\s*=\s*Split\s*\(\s*(?P=var)\s*,\s*[\x22\x27]\s*(?P=var2)\s*[\x22\x27]\s*\)/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170207;Engine:81-255,Target:2;(0&1&(2|3)&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s*(?P<var>[a-z]{5,20})\s*\(\s*\)\s+(?P=var)\s*=\s*(?:[0-9]{1,4}|[\x22\x27][a-z]{3,20}[\x22\x27])\s+End\s*Function/si;1/Function\s*(?P<var>[a-z]{3,25})\s*\(\s*\)\s+(?P<var2>[a-z]{3,20})\s*=\s*(?:True|False)\s+(?P=var)\s*[<>=]{1,2}\s*(?P=var2)\s+End\s*Function/si;53706c6974::i;5368656c6c::i;54686973446f63756d656e742e43757272656e7452736964::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilHTML.UnkHTMLDL.170209;Engine:81-255,Target:3;(0&1&2&3&4&5&6);3c7363726970743e766172::i;3d226a7322::i;656c656d656e74::i;7372633d2268747470::i;766172::i;4/var[a-z]{3,20}=(?:[a-z]{3,20}(?:\+)?){20,}/si;7072696e74207468697320646f63756d656e7420706c65617365::i
#MiscreantPunch.EvilMacro.MultiPSDL.170210;Engine:81-255,Target:2;(0&1>50&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;44696d::i;1/Dim\s*(?P<var1>[a-z]{10,30})\s*As\s*(?:Integer|String)\s+(?P=var1)\s*=\s*(?:[0-9]{1,3}|[\x22\x27][a-z]{3,30}[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s*(?P<var2>[a-z]{10,30})\s*As\s*(?:Integer|String)\s+(?P=var2)\s*=\s*(?:[0-9]{1,3}|[\x22\x27][a-z]{3,30}[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s*(?P<var3>[a-z]{10,30})\s*As\s*(?:Integer|String)\s+(?P=var3)\s*=\s*(?:[0-9]{1,3}|[\x22\x27][a-z]{3,30}[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s*(?P<var4>[a-z]{10,30})\s*As\s*(?:Integer|String)\s+(?P=var4)\s*=\s*(?:[0-9]{1,3}|[\x22\x27][a-z]{3,30}[\x22\x27])\s+/si;4d6964::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170210;Target:2;(0&1&(2|3)&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*\)\s+(?P<var2>[a-z]{3,20})\s*=\s*(?:True|Empty)\s+(?P=var1)\s*=\s*(?P=var2)\s+End\s+Function/si;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*\)\s+(?P=var1)\s*=\s*(?:True|Empty)\s+End\s+Function/si;54686973446f63756d656e742e43757272656e7452736964::i;53706c6974::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170213;Engine:81-255,Target:2;(0&1&(2|3)&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*\)\s+(?P<var2>[a-z]{3,20})\s*=\s*(?:True|Empty|False)\s+(?P=var1)\s*=\s*(?P=var2)\s+End\s+Function/si;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*\)\s+(?P=var1)\s*=\s*(?:True|Empty|False)\s+End\s+Function/si;5468656e::i;4/(?P<var>[a-z]{3,20})\s*=\s*[\x22\x27]\s*c(?P<var2>[a-z]{2,4})m(?P=var2)D(?P=var2)?\.(?P=var2)?(?:[\x20-\x7e]{1,5}(?P=var2)[\x20-\x7e]{1,5})+\s+(?P<var3>[a-z]{2,15})\s*=\s*[\x22\x27](?P=var2)[\x22\x27]\s+[a-z]{3,20}\s*=\s*Split\s*\(\s*(?P=var)\s*,\s*(?P=var3)\s*\)/si;53706c6974::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EXEInsideOfDoc.B64.2;Engine:81-255,Target:0;(0&(1|2|3));786d6c6e733d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f*3c73693e3c743e545671514141;5647687063794277636d396e636d467449474e68626d3576644342695a534279645734676157346752453954494731765a4755;647687063794277636d396e636d467449474e68626d3576644342695a534279645734676157346752453954494731765a47557;591da1c18de509dd8db4e5b98db519d1251d39a189b4d5d9910d09a5694d09e5915cd19d855cd19d4914e551251cc5d9691d55
MiscreantPunch.EvilMacro.UnkPSDL.170214;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;4e65772d4f626a656374::i;2e446f776e6c6f616446696c65::i;2e657865::i;53746172742d50726f63657373::i;5368656c6c::i;4d7367426f78::i;6572726f72::i
MiscreantPunch.EvilMacro.Dridex.170214;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16&(17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35|36));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var>[A-Za-z]{3,20})\s+As\s+Integer\s+For\s+(?P=var)\s*=\s*[0-9]\s*To\s*[0-9]\s+DoEvents\s+Next\s*(?P=var)/si;4d7367426f78::i;4372656174654f626a65637428::i;2e52756e28::i;203d20227022::i;203d20226f22::i;203d20227722::i;203d20226522::i;203d20227222::i;203d20227322::i;203d20226822::i;203d20226522::i;203d20226c22::i;203d20226c22::i;203d20227822::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170214;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;416374697665446f63756d656e742e57696e646f77732e436f756e74::i;43617365::i;53706c6974::i;5468656e::i;0/(?P<var1>[a-z]{3,20})\s*=\s*(?:[a-z]{3,10}\s*(?:\s*&\s*)?){8,}\s+(?P<var2>[a-z]{3,20})\s*=\s*[\x22\x27]\s*[a-z]{2,4}\s*[\x22\x27]\s+[a-z]{3,20}\s*=\s*Split\s*\(\s*(?P=var1)\s*,\s*(?P=var2)\s*\)/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Hancitor.170214;Engine:81-255,Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;2349662057696e3634205468656e::i;4c696220225573657233322e646c6c2220416c696173202247726179537472696e674122::i;5642412e537472436f6e76::i;766246726f6d556e69636f6465::i;46756e6374696f6e::i;5/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*(?P<var2>[a-z]{3,20})\s*,\s*(?P<var3>[a-z]{3,20})\s*,\s*(?P<var4>[a-z]{3,20})\s*\)\s+Select\s*Case\s*(?P=var4)\s+Case\s*[0-9]{1,4}\s+(?:(?P=var1)\s*=\s*(?P=var2)\s*(?:\\|\*|And|\+|\-)\s*(?P=var3)\s+(?:Case\s*[0-9]{1,4}\s+)?)+End\s+Select/si
MiscreantPunch.EvilMacro.Pony.170214;Engine:81-255,Target:2;(0&1&2&3&(4|5));4174747269627574652056425f::i;46756e6374696f6e2057696e45786563204c696220226b65726e656c333222::i;43616c6c2057696e4578656328::i;44696d::i;3/Dim\s+(?P<var1>[a-z]{3,20})\s*As\s*(?:Double|Long|Integer|String)\s+Dim\s+(?P<var2>[a-z]{3,20})\s*As\s*(?:Double|Long|Integer|String)\s+(?P=var1)\s*=\s*[0-9]{1,4}\s+(?P=var2)\s*=\s*[0-9]{1,4}\s+(?:\x27[a-z]+\s+)?If\s+(?P=var1)\s*[<>=]{1,2}\s*(?P=var2)\s*Then/si;3/Dim\s+(?P<var1>[a-z]{3,20})\s*As\s*Integer\s+(?P=var1)\s*=\s*[0-9]{1,4}\s+\x27[a-z]+/si
#MiscreantPunch.EvilMacro.MultiPSDL.M2.170214;Engine:81-255,Target:2;(0&1&(2|3)&(3|4)&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*\)\s+(?P<var2>[a-z]{3,20})\s*=\s*(?:True|Empty|False)\s+(?P=var1)\s*=\s*(?P=var2)\s+End\s+Function/si;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*\)\s+(?P=var1)\s*=\s*(?:True|Empty|False)\s+End\s+Function/si;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*\)\s+(?P=var1)\s*=\s*(?:[\x22\x27][a-z]+[\x22\x27]|[0-9]{1,4})\s+End\s+Function/si;5468656e::i;53706c6974::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170221;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;4372656174654f626a656374::i;5368656c6c::i;4c656e::i;4d6964::i;4a6f696e28::i;0/(?P<var1>[a-z]{3,30})\s*=\s*[0-9]{1,4}\s+(?:\x27[a-z]+\s+)+If\s*(?P=var1)\s*[<>=]{1,2}\s*[0-9]{1,4}\s*Then\s+(?:\x27[a-z]+\s+)+/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170221;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4372656174654f626a656374::i;76627363726970742e726567657870::i;44696d::i;3/Dim\s*(?P<var1>[A-Za-z]{3,20})\s*As\s*Integer\s+Dim\s*(?P<var2>[A-Za-z]{3,20})\s*As\s*Integer\s+(?P=var1)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+If\s*(?P=var1)\s*[<>=]{1,2}\s*[0-9]{1,4}\s*Then\s+(?P=var2)\s*[<>=]{1,2}\s*[0-9]{1,4}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.PiratedOfficeVersionWithMacros;Target:2;(0&1);5350656369616C6953542052655061636B::faw;5C564245(35|36|37)2E444C4C::aw
MiscreantPunch.SWF.GenericExploit.170221;Target:11;(0&1&2&3&4);096c6f61644279746573;064c6f61646572;0A63686172436f64654174;023078;ff15????0000??00{1-65535}30393039303930393039303930393039303930393039303930393039303930393039303930393039
MiscreantPunch.SWF.SunDownEK.170221;Engine:81-255,Target:11;(0);ff15????0000??00{1-10000}07476F5F76617231{1-10000}45423530333146363634384237363330384237363043384237363143384236453038
MiscreantPunch.EvilMacro.Cerber.170222;Engine:81-255,Target:2;(0&1&2&((3|4|5|6)>5)&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*(?P<var2>[a-z]{3,20})\s*\)\s+[a-z]{3,20}\s*=\s*[0-9]{1,4}\s+(?P=var1)\s*=\s*(?P=var2)\s+End\s+Function/si;225e::i;5e22::i;5c275e::i;5e5c27::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170222;Engine:81-255,Target:2;(0&1&2>20&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;4c696220226b65726e656c333222::i;53747252657665727365::i;4d6b446972::i;536c656570::i;4f70656e::i;466f722042696e6172792041732023::i;5075742023::i;436c6f73652023::i;5368656c6c::i;4d7367426f78::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170223;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;4a6f696e28::i;4372656174654f626a65637428::i;4c656e28::i;4d696428::i;4d6f64756c65312e::i;0/(?P<var>[a-z]{3,30})\s*=\s*[0-9]{1,4}\s+\x27[a-z]+\s+(?:\x27[a-z]+\s+)?If\s+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+Then\s+\x27[a-z]+/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.DL.170224;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;4372656174654f626a65637428::i;536574::i;4368722841736328::i;2e4f70656e::i;2e7772697465::i;2e73617665746f66696c65::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170227;Engine:81-255,Target:2;(0&1&2&3>15&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s+(?P<var1>[a-z0-9]{2,20})\s*\(\s*(?P<var2>[a-z0-9]{2,20})\s*\)\s+(?P<var3>[a-z0-9]{2,20})\s*[<>=]{1,2}\s*(?P=var2)\s+(?P=var1)\s*[<>=]{1,2}\s*(?P=var3)\s+End\s+Function/si;41727261792822::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170227;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var1>[a-z]{10,30})\s+As\s+Integer\s+(?:\x27[a-z]+\s+)?(?P=var1)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+(?:\x27[a-z]+\s+)?End\s+If\s+(?:\x27[a-z]+\s+)?(?P<var2>[a-z]{10,30})\s*[<>=]{1,2}\s*[0-9]{1,4}\s+(?:\x27[a-z]+\s+)?If\s+(?P=var2)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+Then/si;416374697665446f63756d656e742e5368617065732e53656c656374416c6c::i;4372656174654f626a65637428::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PandaBanker.170228;Engine:81-255,Target:2;(0&1>50&2&3>300&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;44696d20::i;1/Dim\s+[a-z0-9]{3,20}\s+(?:(?:Dim\s+(?:[a-z0-9]{3,20}(?:\s*,\s*)?)+)+\s+){20,}/si;203d2022::i;417272617928::i;5368656c6c204a6f696e28::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Unk.170224;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;25414c4c555345525350524f46494c45255c696e7465726e65742d73657474696e67732e6a73::i;4372656174654f626a6563742822575363726970742e5368656c6c2229::i;44697228::i;43616c6c::i;2e52756e20::i;4d7367426f78::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170306;Engine:81-255,Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;4c656e28::i;44696d::i;2/Dim\s+(?P<var>[a-z]{3,20})\s+As\s+Integer\s+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+If\s+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s*Then/si;2e7348454c6c455865635554652022636d642e65786522::i;226f70656e22::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170306;Engine:81-255,Target:2;(0&1&2&3>50&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s+(?P<var1>[a-z]{3,20})\s*\(\s*(?P<var2>[a-z]{3,20})\s*,\s*(?P<var3>[a-z]{3,20})\s*,\s*[a-z]{3,20}\s*\)\s+(?P=var2)\s*=\s*[\x22\x27]\s*[a-z]{30,}\s*[\x22\x27]\s+(?P<var4>[a-z]{3,20})\s*=\s*(?P=var3)\s*(?P=var1)\s*=\s*(?P=var4)\s+End\s+Function/si;417272617928::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.PDF.CVE-2010-0188.Exploit.170306;Engine:81-255,Container:CL_TYPE_PDF,Target:0;(0&1&2);3c496d6167654669656c6431::i;746966::i;53556b7141446767414143516b4a43516b4a43516b4a43516b4a43516b4a43516b4a4351*6b4a43516b4a43516b4a43516b4a43516b4a43516b4a4351*4441774d4441774d4441774d4441774d4441774d44::i
MiscreantPunch.PDF.CVE-2010-0188.Exploit.Rev.170306;Engine:81-255,Container:CL_TYPE_PDF,Target:0;(0&1&2&3&4&(5|6));3c696d61676565646974::i;3c786661::i;7265706c616365::i;282e292e2f67::i;72657665727365::i;71??6b??55??53??223e;71??6b??55??53??273e
MiscreantPunch.EvilMacro.VPFCHRDLSADN;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));26204368722831332920262043687228313329205f::i;566972757350726f74656374696f6e203d2046616c7365::i;44656c6574654c696e6573::i;536176654173::i;496620446179284e6f77282929203d2031205468656e::i;4c6f6f7020556e74696c::i;564250726f6a656374::i;436f756e744f664c696e6573::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170307;Engine:81-255,Target:2;(0&1>50&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;417272617928::i;5468656e::i;2/Then\s+(?P<var>[a-z]{3,15})\s*=\s*(?:[a-z]{3,15}(?:\s*\+\s*)?){50,}\s+Shell\s*(?P=var)\s*,\s*(?:[a-z]{3,15}(?:\s*\+\s*)?)*\s+End\s+If/s;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.AORSSTRCONCRT.170307;Engine:81-255,Target:2;((0|1|2|3)>5&(4|5)>20&(6|7)&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27)&(28|29));225e;5e22;225e;5e22;202620;202b20;5368656c6c::i;52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;4/\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s/;5/\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s/
#MiscreantPunch.EvilMacro.AORSSTRCONCRT.170307;Engine:81-255,Target:2;((0|1|2|3)>5&(4|5)>20&(6|7)&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27)&(28|29));225e;5e22;225e;5e22;202620;202b20;5368656c6c::fi;2e52756e::fi;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;4/\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s{0,1000}(?:\bshell\b|\x2erun\b)/si;5/\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s[^\r\n]{1,50}\s[&+]\s.{0,1000}(?:\bshell\b|\x2erun\b)/si
MiscreantPunch.EvilMacro.DridexDoc.170307;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4372656174654f626a65637428::i;43616c6c42794e616d6528::i;56624d6574686f64::i;575363726970742e5368656c6c::i;203d20225222::i;203d20227522::i;203d20226e22::i;203d20222e6a22::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170308;Engine:81-255,Target:2;(0&1>50&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;203d20417272617928::i;2229::i;2/(?P<var1>[a-z]{3,20})\s*=\s*Array\s*\(\s*[a-z]{3,20}\s*\(\s*\d\s*\)\s*,\s*(?:(?:[a-z0-9]{3,20}\s*\(\s*\d\s*\)(\s*,\s*)?)+(\s*_\s*,\s*)?)+\)\s+(?P<var2>[a-z]{3,20})\s*=\s*Join\s*\((?P=var1)\s*.+?\)\s+Shell\s*(?P=var2)/si;4a6f696e28::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170308;Engine:81-255,Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var>[a-z]{3,20})\s*As\s+Boolean\s+(?P=var)\s*=\s*[0-9]{1,4}\s+/si;4e657874::i;3/Next\s+[a-z]{3,20}\s*=\s*CreateObject\([a-z]{3,20}\)\s*\.Run\([a-z]{3,20}\s*,\s*False\s*\)\s+End\s+Sub/si;4372656174654f626a65637428::i;2e52756e28::i
MiscreantPunch.EvilMacro.PSDL.170308;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;43687228::i;4368722831303129::i;4368722831313429::i;43687228383329::i;4368722831303429::i;4368722831303129::i;43687228373629::i;2e655865::i;4372656174654f626a65637428::i;2e52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Encrypted.Ursnif.170314;Engine:81-255,Target:2;(0);73616c7456616c75653d227768547050472f52713277786b336e395157617a54413d3d::aw
MiscreantPunch.EvilMacro.MultiPSDL.170314;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8);4174747269627574652056425f::i;2349662057696e3634205468656e::i;23456c7365::i;23456e64204966::i;4c696220224e74646c6c2e646c6c202220416c69617320224e74416c6c6f636174655669727475616c4d656d6f727922::i;4c696220224e74646c6c2e646c6c20202220416c69617320225a7757726974655669727475616c4d656d6f727922::i;4c6962202253686c776170692e646c6c2220416c69617320225061746846696c6545786973747322::i;204173204c6f6e67::i;7/As\s+Long\s+\x27\s*[\x20-\x7e]+\s+\x27\s*[\x20-\x7e]+/si
MiscreantPunch.EvilMacro.MultiPSDL.M2.170314;Engine:81-255,Target:2;(0&1>70&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;203d204172726179284e614e::i;2022::i;2e7265706c61636528::i;4a6f696e::i;5368656c6c::i;766268696465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M3.170314;Engine:81-255,Target:2;(0&1&(2|3)>30&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;41727261792822636d642e657865202f6320::i;41727261792822::i;4172726179284e614e::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170315;Engine:81-255,Target:2;(0&1>30&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4172726179284e614e::i;22636d642e657865202f6320::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSHOBFUSEXE.170316;Engine:81-255,Target:2;(0&1&2&(3|4)&(5|6)>15&7=0);4174747269627574652056425f;2e657865::i;53746172742d50726f63657373::i;5368656c6c::fi;2e52756e::fi;202b20;202620;706f7765727368656c6c::i
MiscreantPunch.EvilMacro.MultiPSDL.170318;Engine:81-255,Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;5368656c6c::i;44696d::i;2/Dim\s+(?P<var1>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var1)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s+(?P<var2>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var2)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s+(?P<var3>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var3)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s+(?P<var4>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var4)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?/si;53656c656374696f6e2e5479706554657874::i;4/\s+\(\s*[\x22\x27][\x20-\x7e]+[\x22\x27]\s*&\s*vbCrLf\s*\)/si
MiscreantPunch.EvilMacro.MultiPSDL.M2.170318;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4372656174654f626a6563742822575363726970742e5368656c6c2229::i;456e64204966::i;2/\s+[a-z0-9]{3,20}\s*=\s*[a-z0-9]{3,20}\s*\(\s*[\x22\x27]([A-Za-z0-9]{3,6})\s*[\x22\x27]\s*,\s*[\x22\x27][^\1]?(?:\1[\x20-\x7e]){5,}\s*,\s*(?:[0-9]{1,2}|[\x22\x27]\s*(?:True|False)\s*[\x22\x27]\s)?\)/si;43616c6c42794e616d65::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170320;Engine:81-255,Target:2;(0&1&2&3&4&(5|6)&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var1>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var1)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s+(?P<var2>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var2)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s+(?P<var3>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var3)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?Dim\s+(?P<var4>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var4)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+(?:[\x27][a-z]+\s+)?/si;4c656e::i;4d6964::i;77736372697074::if;4372656174654f626a656374::if;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.INFO.LNK.CMDBITSADMIN;Engine:81-255,Target:0;(0&1);4c0000000114020000000000C000000000000046*636d642e657865::i;0/cmd.exe.+?b\x00i\x00t\x00s\x00a\x00d\x00m\x00i\x00n.+?t\x00r\x00a\x00n\x00s\x00f\x00e\x00r/si
MiscreantPunch.INFO.LNK.BITSADMIN;Engine:81-255,Target:0;(0&1);4c0000000114020000000000C000000000000046*5c636d642e657865::i;0/bitsadmin.exe.+?\x00t\x00r\x00a\x00n\x00s\x00f\x00e\x00r/si
MiscreantPunch.XLS.CVE_2016_7262;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1&2&3&(4|5));3c3f786d6c::i;3c65787465726e616c4c696e6b::i;646465546f706963::i;44646553657276696365::i;2/ddeTopic\s*=\s*[\x22\x27][^\x22\x27]+\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)[\x22\x27\b]/si;3/ddeservice\s*=\s*[\x22\x27](?:(?:vb|w)script|c(?:script|md)|powershell|bitsadmin|mshta)(?:\.exe)?[\x22\x27]/si
MiscreantPunch.EvilMacro.AVSCVBNF.170327;Engine:81-255,Target:2;(0&1&2&(3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22));4174747269627574652056425f::i;5368656c6c2022636d64202f63207264202f73202f71::i;76624d696e696d697a65644e6f466f637573::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.LNK.CMDMSHTAVBSCRIPT;Engine:81-255,Target:0;(0&(1|2));4c0000000114020000000000C000000000000046*5C6D736874612E657865*760062007300630072006900700074003A0045007800650063007500740065*4700650074004F0062006A006500630074::i;776f72642e::iw;657863656c2e::iw
MiscreantPunch.EvilMacro.MultiPSDL.M1.170328;Engine:81-255,Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var1>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var1)\s*[<>=]{1,2}\s*(?:[0-9]{1,4}|[\x22\x27][^\x22\x27]+[\x22\x27])\s+If\s*(?P=var1)\s*[<>=]{1,2}\s*[0-9]{1,4}\s*Then/si;0/[a-z]{3,20}\s*=\s*[\x22\x27][^c]{0,4}c[^m]{0,4}m[^d]{0,4}d[^\.]{0,4}\.[^e]{0,4}e[^x]{0,4}x[^e]{0,4}e[^\/]{0,8}\/[^c]{0,4}c[^p]{0,4}p[^o]{0,4}o[^w]{0,4}w[^e]{0,4}e[^r]{0,4}r[^s]{0,4}s[^h]{0,4}h[^e]{0,4}e[^l]{0,4}l[^l]{0,4}l/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.2.170328;Engine:81-255,Target:2;(0&1>150&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;44656275672e5072696e74::i;44696d::i;2/Dim\s+(?P<var>[A-Za-z]{3,20})\s+As\s+(?:Integer|Long)\s+(?P=var)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+If\s+[0-9]{1,6}\s*[\/\*\+\-]\s*[0-9]{1,6}\s*[<>=]{1,2}\s*(?P=var)\s*Then\s+Debug\.Print\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+(?:Else\s+)?(?P=var)\s*=\s*[0-9]{1,6}\s*[\/\*\+\-]\s*[0-9]{1,6}\s+End\s+If/si;4765744f626a656374::i;575363726970742e5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170329;Engine:81-255,Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var3>[a-z]{3,30})\s+As\s+(?:Boolean|String|Double|Byte|Integer)\s+(?P=var3)\s*[<>=]{1,2}\s*[0-9]{1,4}\s+/si;4372656174654f626a65637428::i;43616c6c2043616c6c42794e616d6528::i;43687228::i;3d2022727522202b2043687228373829::i
MiscreantPunch.EvilMacro.DarkNeuron.170330;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;2d2d424547494e2043455254494649434154452d2d::i;20262022::i;2d2d454e442043455254494649434154452d2d::i;4372656174654f626a65637428::i;456e7669726f6e282254656d702229::i;53747252657665727365::i;5772697465::i;575363726970742e5368656c6c::i;636d642e657865202f63::i;636572747574696c202d6465636f6465::i;2e52756e::i;51715654::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.MultiPSDL;Engine:81-255,Target:2;(0&1&2);0800000061646d696e;08000000646f6f64;5c564245(36|37)2e444c4c
MiscreantPunch.EvilMacro.PSDLviaComment.170403;Engine:81-255,Target:2;(0&1&(2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21));4174747269627574652056425f::i;5368656c6c2028416374697665446f63756d656e742e4275696c74496e446f63756d656e7450726f706572746965732822436f6d6d656e747322292e56616c756529::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.CVE_2012_1856.CommonConstruct;Target:2;(0>50);7C01020000{78}010000{251}C36F377CC36F377CC36F377CC36F377C
MiscreantPunch.EvilDoc.CVE_2012_1856.CommonConStruct.2;Target:2;(0>10);90909090EB7F414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141412490909090??FFFFFFFF
MiscreantPunch.EvilMacro.VBDL.170404;Engine:81-255,Target:2;(0&1&2&(3|4)&5&7&8);4174747269627574652056425f::i;5c50726f6772616d73::i;5c53746172747570::i;2e72756e::i;7368656c6c::i;68747470*2e657865::i;433a*2e657865::i;5/https?\x3a\/\/[^\x22\x27\r\n]+\.exe\b/si;6/c\x3a[^\r\n\x22\x27]+\.exe\b/si
MiscreantPunch.HTA.EvilHTA.20170409;Engine:81-255,Target:3;(0&1&2&3&4&5);2e657870616e64656e7669726f6e6d656e74737472696e677328;2e72756e22706f7765727368656c6c;2e72756e22636d642e657865;726573696c69656e6379202d72656375727365;777363726970742e7368656c6c;6d656e7570726f6772616d7373746172747570
MiscreantPunch.RTF.EvilRTF.20170409;Engine:81-255,Target:0;(0&1);0:7b5c7274*5c6f626a6175746c696e6b*34663463343533323463363936653662*64306366313165306131623131616531::i;303036383030373430303734303037::i
MiscreantPunch.EvilDoc.Hancitor.170411;Engine:81-255,Target:2;(0&1&2);214d495a4f4c;4d6163726f73::w;5c564245(36|37)2e444c4c::i
MiscreantPunch.EvilMacro.MultiPSDL.170411;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;54686973446f63756d656e742e53656374696f6e732e436f756e74::i;4368722428::i;5368656c6c::i;55426f756e6428::i;4c656e28::i;44696d::i;6/Dim\s*(?P<var>[A-Za-z0-9]{3,20})\s*\(\s*\)\s*As\s*Byte\s+(?P=var)\s*=\s*(?P<var2>[A-Za-z0-9]{3,20})\s+[A-Za-z0-9]{3,20}\s*=\s*(?P=var2)/si
MiscreantPunch.EvilMacro.UnkDL.170412;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;46756e6374696f6e::i;1/Function\s*(?P<var>[A-Z]{3,20})\s*\(\s*\)\s+As\s+String\s+(?P=var)\s*=\s*(?P<var2>[A-Z]{3,20})\s*\([\x22\x27][^\x22\x27]+?[\x22\x27]\s*\)\s+End\s+Function\s+Function\s*(?P<var3>[A-Z]{3,20})\s*\(\s*\)\s*As\s+String\s+(?P=var3)\s*=\s*(?P=var2)\s*\([\x22\x27][^\x22\x27]+?[\x22\x27]\s*\)\s+End\s+Function/si;4372656174654f626a65637428::i;2e52756e::i;766248696465::i;43616c6c::i;43687228::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170413;Engine:81-255,Target:2;(0&1&2&3&(4|5|6)&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f;5374725265766572736528;70747468::i;203d20226c6c642e::i;732f::i;206e2f::i;20752f::i;6578652e::i;5368656c6c;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170414;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8);4174747269627574652056425f::i;536574::i;1/Set\s*(?P<var>[a-z]{3,20})\s*=\s*CreateObject\([^\)]+\)\s+(?P=var)\s*.\s*Run/si;4372656174654f626a65637428::i;2e52756e::i;4d7367426f78::i;436f6d70696c6572206572726f72::i;63616e27742066696e642070726f6a656374206f72206c696272617279::i;4d6963726f736f6674204f6666696365::i
#MiscreantPunch.Evil.DotX.20170417;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1&2&3&4);3c52656c6174696f6e73686970::i;6f6c654f626a656374::i;5461726765744d6f6465::i;45787465726e616c::i;0/<Relationship(?=[^>]+Type\s*=\s*[\x22\x27]?[^\x22\x27\s]+\/relationships\/oleObject)(?=[^>]+Target\s*=\s*[\x22\x27](?:https?|ftp)\x3a\x2f\x2f(?![^\x2f]+\.live\.net\x2f)[^\x22\x27]+\.(?:rtf|hta|do[ct][mx]?)[\x22\x27])[^>]+TargetMode\s*=\s*[\x22\x27]?External/si
#MiscreantPunch.Evil.DotX.20170417.V2;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1&2&3&4);3c52656c6174696f6e73686970::i;6f6c654f626a656374::i;5461726765744d6f6465::i;45787465726e616c::i;0/<Relationship(?=[^>]+Type\s*=\s*[\x22\x27]?[^\x22\x27\s]+\/relationships\/oleObject)(?=[^>]+Target\s*=\s*[\x22\x27](?:https?|ftp)\x3a\x2f\x2f(?:(?!(?:10|192\.168|172\.(?:1[6-9]|2[0-9]|3[0-1])\.))\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[\x2f\x5c]|(?![^\x2f]+\.live\.net\x2f)[^\x22\x27]+\.(?:exe|rtf|hta|do[ct][mx]?|php\?[^\x22\x27]+)[\x22\x27]))[^>]+TargetMode\s*=\s*[\x22\x27]?External/s
#MiscreantPunch.Evil.DotX.20170417.V3;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1&2&3&4);3c52656c6174696f6e73686970::i;6f6c654f626a656374::i;5461726765744d6f6465::i;45787465726e616c::i;0/<Relationship(?=[^>]+Type\s*=\s*[\x22\x27]?[^\x22\x27\s]+\x2frelationships\x2foleObject)(?=[^>]+Target\s*=\s*[\x22\x27](?:(?:\x25[46]8|h)(?:\x25[57]4|t){2}(?:\x25[57]0|p)(?:\x25[57]3|s)?|(?:\x225[46]6|f)(?:\x25[57]4|t)(?:\x25[57]0|p))(?:\x253a|\x3a)(?:\x252f|\x2f){2}(?:(?!(?:10|192\.168|172\.(?:1[6-9]|2[0-9]|3[0-1])\.))\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[\x2f\x5c]|(?=[^\x2f\x3a\x5c\x22\x27]*(?:\x252e|\x2e))(?![^\x2f]+\.live\.net\x2f)[^\x22\x27]+(?:\x252e|\x2e)(?:(?:\x25[46]4|d)(?:\x25[46]f|o)(?:\x25(?:[46]3|[57]4)|c|t)(?:\x25(?:[46]d|[57]8)|m|x)?|(?:\x25[57]0|p)(?:\x25[46]8|h)(?:\x25[57]0|p)(?:\x253f|\x3f)[^\x22\x27]+|(?:\x25[46]5|e)(?:\x25[57]8|x)(?:\x25[46]5|e)|(?:\x25[46]8|h)(?:\x25[57]4|t)(?:\x25[46]1|a)|(?:\x25[57]2|r)(?:\x25[57]4|t)(?:\x25[46]5|f)|(?:\x25[57]7|w)(?:\x25[46]2|b)(?:\x25[46]b|k))[\x22\x27]))[^>]+TargetMode\s*=\s*[\x22\x27]?External/si
MiscreantPunch.EvilMacro.MultiPSDL.170419;Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;43616c6c205642412e43616c6c42794e616d6528::i;4372656174654f626a65637428::i;5265706c61636528::i;203d20::i;4/\s*=\s*[\x22\x27][^c]{0,4}c[^m]{0,4}m[^d]{0,4}d[^\.]{0,4}\.[^e]{0,4}e[^x]{0,4}x[^e]{0,4}e[^\/]{0,4}\/[^c]{0,4}c[^p]{0,4}p[^o]{0,4}o[^w]{0,4}w[^e]{0,4}e[^r]{0,4}r[^s]{0,4}s[^h]{0,4}h[^e]{0,4}e[^l]{0,4}l[^l]{0,4}[^\.]{0,4}\.[^e]{0,4}e[^x]{0,4}x[^e]{0,4}e/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199-Obfus;Engine:81-255,Target:0;(0);0:7b5c7274!(66)*5c6f626a757064617465
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199-CommonConstruct;Engine:81-255,Container:CL_TYPE_RTF,FileSize:2000-20000,Target:2;0;010000020900000001000000000000000000000000000000{2}0000E0C9EA79F9BACE118C8200AA004BA90B{4}6800740074007000
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.CommonConstruct.M2;Engine:81-255,Container:CL_TYPE_RTF,FileSize:2000-20000,Target:2;0;000000010000000000000000000000000000005c010000e0c9ea79f9bace118c8200aa004ba90b440100006800740074007000
MiscreantPunch.EvilPDF.Dridex20170419;Engine:81-255,Target:10;(0&1&2&3&4);2f456d62656464656446696c6573::i;2f4e616d6573::i;2f4a617661536372697074::i;2f547970652f50616765732f436f756e742031::i;1/\/Names\s*\[\s*\(\s*\d{4,}\.docm/is
MiscreantPunch.EvilHTA.HTADL170421;Target:0;(0&1&2&3&4&5&6);0:504b;646f63756d656e742e786d6c::i;3c736372697074::i;77696e646f772e726573697a65546f2830::i;77696e646f772e6d6f7665546f282d::i;77696e646f772e636c6f7365::i;6e657720416374697665584f626a656374::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.CommonConstruct.M3;Engine:81-255,Container:CL_TYPE_RTF,Target:2;(0);E0C9EA79F9BACE118C8200AA004BA90B{5-7}00740070{3-1000}2e006800740061000000
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.CommonConstruct.M5;Target:0;(0&1&2);0:7b5c7274;456e61626c652045646974696e6720746f2076696577207468697320646f63756d656e742e::i;5c6f626a757064617465::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.CommonConstruct.M6;Target:0;(0&1&2);0:7b5c7274;5c6f626a757064617465::i;3030303030303031303030303030303030303030303030303030303030303030303030303030356330313030303065306339656137396639626163653131386338323030616130303462613930623434303130303030::i
MiscreantPunch.EvilMacro.MultiPSDL.170425;Engine:81-255,Target:2;(0&1&2&3&4&5&6>10&7&8&9);4174747269627574652056425f::i;6f584d4c2e437265617465456c656d656e7428226261736536342229::i;2e6461746154797065203d202262696e2e62617365363422::i;42696e61727953747265616d203d204372656174654f626a656374282241444f44422e53747265616d2229::i;2e4f70656e::i;2e5772697465::i;203d20417363::i;537472436f6e76::i;44696d::i;8/Dim\s+(?P<var1>[A-Za-z0-9]{3,20})\s+As\s+(?:String|Double|Long|Boolean|Byte|Single)\s+(?P=var1)\s*=\s*(?:True|False)?(?:Val|Sgn|Asc[A-Za-z])?(?:\([\x22\x27]?[A-Za-z0-9]{1,}[\x22\x27]\))?(?:\(?[0-9]+\)?)?(?:\.[0-9]+\)?)?\s+Dim\s+(?P<var2>[A-Za-z0-9]{3,20})\s+As\s+(?:String|Double|Long|Boolean|Byte|Single)\s+(?P=var2)\s*=\s*(?:True|False)?(?:Val|Sgn|Asc[A-Za-z])?(?:\([\x22\x27]?[A-Za-z0-9]{1,}[\x22\x27]\))?(?:\(?[0-9]+\)?)?(?:\.[0-9]+\)?)?\s+Dim\s+(?P<var3>[A-Za-z0-9]{3,20})\s+As\s+(?:String|Double|Long|Boolean|Byte|Single)\s+(?P=var3)\s*=\s*(?:True|False)?(?:Val|Sgn|Asc[A-Za-z])?(?:\([\x22\x27]?[A-Za-z0-9]{1,}[\x22\x27]\))?(?:\(?[0-9]+\)?)?(?:\.[0-9]+\)?)?\s+Dim\s+(?P<var4>[A-Za-z0-9]{3,20})\s+As\s+(?:String|Double|Long|Boolean|Byte|Single)\s+(?P=var4)\s*=\s*(?:True|False)?(?:Val|Sgn|Asc[A-Za-z])?(?:\([\x22\x27]?[A-Za-z0-9]{1,}[\x22\x27]\))?(?:\(?[0-9]+\)?)?(?:\.[0-9]+\)?)?/si
MiscreantPunch.SWF.SunDownGF.04262017;Engine:81-255,Target:11;(0&1&2&3&4&5&6&(7|8|9)&10);55524c4c6f6164657244617461466f726d6174::i;023078::i;636861724174::i;746f537472696e67::i;6c6f61644279746573::i;4269746d617044617461::i;3638373437343730::i;343335373533::i;343635373533::i;356135373533::i;2402a22401a0{1-500}2402a3
MiscreantPunch.SWF.AstrumEK.20170426;Engine:81-255,Target:11;(0&1>1&2&3&4&5);6c6f61646572496e666f;d030d140??2910{5-50}d2aa4847;a866??aa61??08??62;a44847;ff15??????????0000000000;777269746542797465
MiscreantPunch.EvilMacro.MultiPSDL.170426;Engine:81-255,Target:2;(0&1&2&3&4=2&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;2349662056424137205468656e::i;23456c7365::i;23456e64204966::i;4c6962202275726c6d6f6e2220416c696173202255524c446f776e6c6f6164546f46696c654122::i;4372656174654f626a65637428::i;5370656369616c466f6c64657273::i;2e52756e::i;586f72::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.PDF.Emotet.LINK2JS;Engine:51-255,Container:CL_TYPE_PDF,Target:7;(0&1&2&3&4);796f75206861766520726563656976656420616e20696e766f6963652066726f6d;5b285c28796f7572207265706f727420697320617474616368656420696e206a7320666f726d61745c29295d;6265737420726567617264732c203c;6f70656e20746865206174746163686d656e7420746f;68747470
MiscreantPunch.PDF.CVE-2013-2729.M1;Engine:51-255,Container:CL_TYPE_PDF,Target:0;(0&1&2&3&4&5&6);726f703378::if;474d485741::if;565041::if;736c6964655f73697a65::if;6368756e6b78::if;7370726179::if;30783431343134313431::if
MiscreantPunch.PDF.CVE-2013-2729.M2;Engine:51-255,Container:CL_TYPE_PDF,Target:0;(0);3c696d616765*41414c2f414141432f7741414176384141414c2f414141432f7741414176384141414c2f414141432f7741414176384141414c2f41414143::i
MiscreantPunch.RTF.BINEXEInsideRTF;Target:0;0;0:7B5C7274*4d5a9000*546869732070726F6772616D
MiscreantPunch.EvilMacro.MultiPSDL.170501;Engine:81-255,Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;54686973446f63756d656e742e426f6f6b6d61726b732e436f756e74::i;55426f756e64::i;436872::i;5368656c6c::i;466f726d2e45646974::i;52656d20{3-20}0d0a466f726d2e45646974??2e{3-20}203d2022220d0a456c73650d0a52656d20{3-20}0d0a466f726d2e45646974??2e{3-20}203d2022??220d0a::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.CommonConstruct.M7;Target:0;0;0:7B5C7274*5C6F626A6175746C696E6B*5C6F626A7363616C6579313031*303130303030303230393030303030303031303030303030303030303030303030303030303030303030303030303030613430303030303065*0A303130353030303030303030303030307D0A7B5C726573756C74207B5C72746C63685C66637331205C61663331353037205C6C747263685C66637330205C696E737273696431393739333234
MMiscreantPunch.EvilMacro.MultiPSDL.170502;Engine:81-255,Target:2;(0&(1|2|3)&(4|5|6|17|19)&(7|8|9|14|20|21)&(10|11|12|15|16)&(13|18)>5);4174747269627574652056425f::i;634739335a584a7a6147567362::i;4276643256796332686c6247::i;776233646c636e4e6f5a577873::i;4c566470626d527664314e306557786c494568705a47526c62::i;31586157356b6233645464486c735a5342496157526b5a57::i;7456326c755a473933553352356247556753476c6b5a475675::i;56314e6a636d6c77644335546147567362::i;645459334a70634851755532686c6247::i;5855324e79615842304c6c4e6f5a577873::i;55336c7a644756744c6b356c644335585a57::i;4e356333526c6253354f5a58517556325669::i;5465584e305a573075546d56304c6c646c59::i;203d2053676e28;645459334a7063;4756744c6b356c644335585a57;6c7a644756744c6b356c644335585a57;7456326c755a4739;537472436f6e7628;5a473933553352356247556753476c6b5a475675;51755532686c6247;645459334a706348
MiscreantPunch.EvilDoc.Hancitor.170504;Engine:81-255,Target:2;(0&1&2);214e49434f4c;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.OleNativePackageEXEExt.InsideOLE.LikelyMaliciousMissingSrcName;Engine:81-255,Target:2;(0&1);006c006500310030004e00610074006900760065*FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF{4}0200000000000300;0/\xFF\xFF\xFF\xFF\xFF.{4}\x02\x00\x00\x00\x00\x00\x03\x00.{4}[^\x00]+\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\x00/s
MiscreantPunch.SWF.MultiEKFlashExploit.CommonConStruct.20170505;Engine:81-255,Target:11;(0&1&2&3&4);d030{0-500}2404c6732a;fcff7f;fcffffff07;0/\xd0\x30.{0,300}(?P<var1>([\xd4-\xd7]|\x63.))\x2e.(?:[\xd0-\xd3]|\x62.){2}\x46.{2}\xa0\x73\x2a(?P=var1)\x37(?:[\xd4-\xd7]|\x63.)(?:[\xd0-\xd3]|\x62.)\x2e.\xa1\x73\x2a(?P=var1)\x37(?:[\xd4-\xd7]|\x63.)(?:[\xd0-\xd3]|\x62.)\x24\x04\xc6\x73\x2a(?P=var1)\x37(?:[\xd4-\xd7]|\x63.)(?:[\xd0-\xd3]|\x62.)/s;0/\xa0\x73(?P<s1>([\xd4-\xd7]|\x63.))(?:[\xd0-\xd3]|\x62.)(?P<g1>([\xd0-\xd3]|\x62.))\x3c(?P=g1)\x2e.\xa1\x73\x2a(?P=s1)\x37(?:[\xd4-\xd7]|\x63.)(?P=g1)\x24\x04\xc6\x73\x2a/s
MiscreantPunch.MultiPSDL.170505;Engine:81-255,Target:2;(0&1&2=2&3&4);0:4174747269627574652056425f;284e65772d4f626a656374::i;5c6b6172746f73686b612e657865::i;636d64202f63::i;5368656c6c
MiscreantPunch.EvilDoc.EnableMacroLureText;Engine:81-255,Target:2;(0&1&2&3&4&5);446f63756d656e7420{-5}6372656174656420{-5}696e20{-5}6561726c69657220{-5}76657273696f6e20{-5}6f6620{-5}4d6963726f736f667420{-5}4f666669636520::i;0/(?:Excel|Word)/si;546f20::i;2/\s{0,5}(?:view|decrypt|display)\s{0,5}this\s{0,5}(?:content|document)\s{0,5},\s{0,5}please\s{0,5}click\s{0,5}\"Enable\s{0,5}Editing\"\s{0,5}(?:form|from)\s{0,5}the\s{0,5}yellow\s{0,5}bar\s{0,5}and\s{0,5}then\s{0,5}click\s{0,5}\"Enable\s{0,5}Content\"/si;22456e61626c652045646974696e6722;7468652079656c6c6f7720626172
MiscreantPunch.EvilDoc.EmableMacroLureText.M1;Engine:81-255,Target:2;(0&1);4d6963726f736f667420{-5}4f666669636520{-5}3230????;546f20{-5}646973706c617920{-5}74686520{-5}636f6e74656e747320{-5}6f6620{-5}74686520{-5}646f63756d656e7420{-5}636c69636b20{-5}6f6e20{-5}456e61626c6520{-5}436f6e74656e7420{-5}627574746f6e2e::i
MiscreantPunch.EvilDoc.EmableMacroLureText.M2;Engine:81-255,Target:2;(0);546f20{-5}70726f7065726c7920{-5}646973706c617920{-5}74686520{-5}646f63756d656e742c20{-5}706c6561736520{-5}456e61626c6520{-5}436f6e74656e742e
MiscreantPunch.EvilDoc.EnableMacrosLureText.M3.170509;Engine:81-255,Target:2;(0&1&2&3&4);596f75204861766520526563656976656420616e20456e63727970746564204d6573736167652046726f6d::i;5365637572656420446f63756d656e742046696c6520627920496e74656cae205365637572697479::i;44656372797074204d657373616765::w;496e74656cae204d65737361676520446563727970746f72::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EPS.Huer20170509;Engine:81-255,Target:0;(0&1&2&3&4&5);0:252150532d;786f72::i;707574::i;6d6f64::i;65786368::i;0/def\s*\/(?P<var1>\w+)\s*\<[a-f0-9]+\>.+?exch\s*def\s*0\s*1\s*(?P<var2>\w+)\s*length\s*1\s*sub\s*{\s*\/(?P<var3>\w+)\s*exch\s*def\s*(?P=var2)\s*(?P=var3)\s*2\s*copy\s*get\s*(?P=var1)\s*(?P=var3)\s*4\s*mod\s*get\s*xor\s*put\s*}\s*for\s*(?P=var2)\s*}\s*def\s*\<\s*[a-f0-9]{2000}/si
MiscreantPunch.EPS.Huer20170509.M2;Engine:81-255,Target:0;(0&1);0:252150532d;346435613930*3231353436383639373332303730373236663637373236313664::i
MiscreantPunch.Exploit.Possible.CVE-2017-0290;Engine:81-255,Target:7;(0&1&2&3&4&5&6);6e6577::if;6572726f72::if;746f737472696e67::if;63616c6c::if;6d657373616765::if;3e3e::if;0/new\s+error\s*?\(\s*?\)\s*?(?:\)\s*?)?\.\s*?tostring.\s*?call\s*?\(\s*?\{\s*?message\s*?\x3a\s*?(?:(?:0x|\x5cu)[a-f0-9]{8}|\d{9,10})\s*?\>\>\s*?1\s*?\}\s*?\)/s
MiscreantPunch.LNK.CMDREGSRVSCROBJ;Engine:81-255,Target:0;(0);4c0000000114020000000000C000000000000046*5C726567737672*007300630072006F0062006A002E0064006C006C::i
MiscreantPunch.EvilMacro.MultiPSDL.170509;Engine:81-255,Target:2;(2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;44696d::i;0&1/\s*(?P<var>[a-z]{3,20})\s*As\s+String\s+(?P=var)\s*=\s*[\x22\x27][^\x22\x2]+[\x22\x27]\s+(?P=var)\s*=\s*(?P=var)\s*&\s*[\x22\x27][^\x22\x2]+[\x22\x27]\s+CreateObject\s*\((?P=var)\)\s*\.\s*Run/si;575363726970742e5368656c::i;4372656174654f626a656374::i;2e52756e::i;43687228::i;4170706c69636174696f6e2e52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilPDF.DOCMEmbedded.170511;Engine:81-255,Target:10;(0&1&2&3&4&5);255044462d::i;2f4a53::i;2f4a617661536372697074::i;2f456d62656464656446696c6573::i;2f4f70656e416374696f6e::i;6f626a0a3c3c2f547970652f46696c65737065632f46285931464848444c574f2e646f636d292f5546285931464848444c574f2e646f636d29::i
MiscreantPunch.EvilPDF.DOCMEmbedded.170516;Engine:81-255,Target:10;(0&1&2&3&4&5&6&7);2f4e616d6573::i;2f456d62656464656446696c65::i;69546578742047726f7570204e56::i;2f4a617661536372697074::i;2f4a53::i;2e646f636d::i;2f4f70656e416374696f6e::i;0/(?i)\x2fNames(?:(?!endobj).)+?(?:(?-i)[A-Z0-9]{5,9}(?i)\.doc|\.docm)/s
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.CommonConstruct.M4;Engine:81-255,Container:CL_TYPE_RTF,FileSize:2000-250000,Target:2;(0&1);E0C9EA79F9BACE118C8200AA004BA90B{4}6800740074007000;0/^\xE0\xC9\xEA\x79\xF9\xBA\xCE\x11\x8C\x82\x00\xAA\x00\x4B\xA9\x0B.{4}h\x00t\x00t\x00p\x00(?:s\x00)?\x3a\x00\x2f\x00\x2f\x00(?:\d\x00){1,3}\.\x00(?:\d\x00){1,3}\.\x00(?:\d\x00){1,3}\.\x00(?:\d\x00){1,3}\x2f/si
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.MWI;Engine:81-255,Target:2;(0&1);E0C9EA79F9BACE118C8200AA004BA90B{4}6800740074007000;0/\xE0\xC9\xEA\x79\xF9\xBA\xCE\x11\x8C\x82\x00\xAA\x00\x4B\xA9\x0B.{4}h\x00t\x00t\x00p\x00(?:s\x00)?\x3a\x00\x2f\x00\x2f(?:(?!\x00\x00).)+?\?\x00i\x00d\x00=\x00(?:\d\x00)+&\x00a\x00c\x00t\x00=\x00\d\x00/si
MiscreantPunch.EXEInsideOfRTF.2;Engine:81-255,Container:CL_TYPE_RTF,Target:1;(0);0:4d5a{19-}546869732070726f6772616d20
MiscreantPunch.EvilDoc.Hancitor.170516;Engine:81-255,Target:2;(0&1&2);214e4f495345;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilDoc.Hancitor.170517;Engine:81-255,Target:2;(0&1&2);215452555354;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilMacro.MultiPSDL.170517;Engine:81-255,Target:2;(0&1&2);4174747269627574652056425f4e616d65203d2022{3-10}220d0a46756e6374696f6e20{3-20}28290d0a53657420{3-10}203d204372656174654f626a6563742822577363726970742e5368656c6c22290d0a{3-10}2e52756e20{3-10}2c20766248696465;536574;1/\s*(?P<var>[a-z]{3,10})\s*=\s*CreateObject\(\"Wscript\.Shell\"\)\s+(?P=var)\s*\.\s*Run\s*[^\,]+,\s*vbHide\s+End\s+Function/si
MiscreantPunch.EvilMacro.JSDL.170518;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9>125&10>125&11&12&13&(14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33));4174747269627574652056425f::i;4372656174654f626a656374::i;536372697074696e672e46696c6553797374656d4f626a656374::i;2e6a7322::i;4765745370656369616c466f6c646572::i;4f70656e5465787446696c652843537472::i;2e74787422::i;2e52656164416c6c2829::i;2e5772697465::i;2e57726974654c696e652028::i;5265706c6163652822::i;205642412e4372656174654f626a65637428::i;4b696c6c204353747228::i;2e52756e204353747228::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Hancitor.170518;Engine:81-255,Target:2;(0&1&2);214452494654;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilMacro.MultiPSDL.170523;Engine:81-255,Target:2;(0&1=2&2&3);4174747269627574652056425f;25544d50255c616d756c65742e657865;53746172742d::i;2f63::i
MiscreantPunch.EvilMacro.MultiPSDL.2.170523;Engine:81-255,Target:2;(0&1>5&2>100&(3|4|5|6|7)&(8|9|10|11|12|13|14)&(15|16|17|18)&19);4174747269627574652056425f;4172726179284e614e;4e614e;505e::i;506f5e::i;506f775e::i;506f77655e::i;506f7765725e::i;6f775e::i;6f77655e::i;6f7765725e::i;77655e::i;7765725e::i;776572735e::i;775e::i;735e::i;73685e::i;7368655e::i;7368656c5e::i;25706d657425::i
MiscreantPunch.EvilMacro.WMIDL.170523;Engine:81-255,Target:2;(0&1);5075626c69632046756e6374696f6e20;536574206f574d4953657276696365203d204765744f626a656374282277696e6d676d74733a5c5c22202620737472436f6d7075746572202620225c726f6f745c63696d763222290d0a0d0a0d0a20202020496620496e53747228312c2073747243617074696f6e2c202257696e646f77732037222c20766254657874436f6d7061726529205468656e0d0a2020202020202020{3-20}203d202257696e37220d0a20202020456e642049660d0a20202020496620496e53747228312c2073747243617074696f6e2c20225850222c20766254657874436f6d7061726529205468656e0d0a2020202020202020{3-20}203d20225850220d0a20202020456e64204966
MiscreantPunch.EvilMacro.MultiPSDL.3.170523;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;44696d::i;1/Dim\s+(?P<var1>[A-Za-z]{3,20})\s+As\s+String\s+Dim\s+(?P<var2>[A-Za-z]{3,20})\s+As\s+String\s+(?P=var1)\s+=\s+[A-Za-z]{3,20}\s*\.\s*[A-Za-z]{3,20}\s+(?P=var2)\s*=\s*StrReverse\s*\((?P=var1)\s*\)\s+Shell\s*\((?P=var2)\s*\)/si;53747252657665727365::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Hancitor.170525;Engine:81-255,Target:2;(0&1&2);2154554e4553;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
#MiscreantPunch.Evil.PPSX.PSHELL.LINK;Engine:81-255,Container:CL_TYPE_ZIP,Target:7;(0&(1|2)&3&4&5);72656c6174696f6e73686970::i;77736372697074::i;706f7765727368656c6c::i;2f72656c6174696f6e73686970732f68797065726c696e6b::i;3c3f786d6c::i;0/<relationship(?=(?:(?!\/>).?)+?type=[\x27\x22]http\x3a\x2f\x2fschemas\.openxmlformats\.org\x2fofficedocument\x2f2006\x2frelationships\x2fhyperlink[\x22\x27])(?:(?!\/>).?)+?target\s*=\s*[\x27\x22](?:(?!https?\x3a)(?!file\x3a\x2f+(?:[a-bd-z]|\x5c\x5c(?:10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[0-1])\.|[a-z])))[^\x22\x27])*?(?:powershell\b|wscript\b)/si
MiscreantPunch.Evil.PPSX.RUNPROG.LURE;Engine:81-255,Container:CL_TYPE_ZIP,Target:7;((0|1|2)&3&4&5&6&7&8&9&(10|11));3c613a686c696e6b6d6f7573656f766572;3c613a686c696e6b686f766572;3c613a686c696e6b636c69636b;6c6f6164696e67;706c65617365;77616974;7070616374696f6e3a2f2f70726f6772616d22;3c3f786d6c;6f70656e786d6c666f726d6174732e6f72672f70726573656e746174696f6e6d6c2f323030362f;(0|1|2)/<a:hlink(?:mouseover|click|hover)(?:(?!\/>).?)+?action\s*=\s*[\x22\x27]?ppaction\:\/\/program/s;3/loading[\s\x2e]+please[\s\x2e]+wait/s;4/please[\s\x2e]+wait[\s\x2e]+loading/s
MiscreantPunch.EvilDoc.Hancitor.170529;Engine:81-255,Target:2;(0&1&2);215049544552;4d6163726f73::w;5c564245(36|37)2e444c4c::i
MiscreantPunch.EvilMacro.MultiPSDL.170531;Engine:81-255,Target:2;(2&3>4&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;44696d::i;0&1/\s+(?P<var>[a-zA-Z]{3,20})\s+As\s+Integer\s+(?P=var)\s+=\s+[-0-9]{2,5}\s+[\+\-\\]\s+[-0-9]{2,5}\s+If\s+(?P=var)\s*[<>=]{1,2}\s+[0-9]{2,5}\s+Then/si;456c73650d0a{1-20}203d20{1-20}0d0a456e64204966::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.Zip.JS.Inside.HTML;Engine:81-255,Target:0;(0&1&2);46726f6d2068746d6c2d6e6f726d616c697365::i;436f6e74656e742d747970653a206170706c69636174696f6e2f7a69703b626173653634::i;1/(?:u(?:R(?:Vh(?:FL(?:kp[Tz]|mp[Tz])|lL(?:kp[Tz]|mp[Tz]))|Xh(?:FL(?:kp[Tz]|mp[Tz])|lL(?:kp[Tz]|mp[Tz])))|Z(?:Vh(?:FL(?:kp[Tz]|mp[Tz])|lL(?:kp[Tz]|mp[Tz]))|Xh(?:FL(?:kp[Tz]|mp[Tz])|lL(?:kp[Tz]|mp[Tz]))))|L(?:kV(?:4(?:RS5(?:K[Uc]|q[Uc])|ZS5(?:K[Uc]|q[Uc]))|Y(?:RS5(?:K[Uc]|q[Uc])|ZS5(?:K[Uc]|q[Uc])))|mV(?:4(?:RS5(?:K[Uc]|q[Uc])|ZS5(?:K[Uc]|q[Uc]))|Y(?:RS5(?:K[Uc]|q[Uc])|ZS5(?:K[Uc]|q[Uc]))))|5(?:F(?:W(?:EUu(?:S[ln]|a[ln])|GUu(?:S[ln]|a[ln]))|e(?:EUu(?:S[ln]|a[ln])|GUu(?:S[ln]|a[ln])))|l(?:W(?:EUu(?:S[ln]|a[ln])|GUu(?:S[ln]|a[ln]))|e(?:EUu(?:S[ln]|a[ln])|GUu(?:S[ln]|a[ln])))))/
MiscreantPunch.EvilRTF.20170106;Engine:81-255,Target:0;(0&1&2);0:7b5c7274;456E61626C652045646974696E67::i;32653030(34|36)383030(35|37)343030(34|36)31
MiscreantPunch.SHRSCTSK;Engine:81-255,Target:2;(0&1);5368656c6c2053747252657665727365::i;736b736174686373::i
MiscreantPunch.EvilMacro.PowershellB64;Engine:81-255,Target:2;(0>1&1&2);203d202d;(22|27)634739335a584a7a614756;4174747269627574652056425f::i
MiscreantPunch.EvilOffice.HLINKSCRIPTRURL;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&(1|2)&3&4&5);48595045524c494e4b::if;7363726970743a68747470::i;7363726970746c65743a68747470::i;786d6c6e733a::i;3c3f786d6c::i;0/HYPERLINK\s*\(?\s*[\x22\x27]script(?:let)?\x3a+https?\x3a\x2f\x2f/si
#MiscreantPunch.EvilRTF.CVE-2017-0199.CommonStruct.9;Engine:81-255,Target:0;(0&(1|2)&3);0:7b5c7274;5c6f626a656d62*6530;5c6f626a6c696e6b*6530::i;(1|2)/E0(?!C9EA79F9BACE118C8200AA004BA90B).{0,100}?C.{0,100}?9.{0,100}?E.{0,100}?A.{0,100}?7.{0,100}?9.{0,100}?F.{0,100}?9.{0,100}?B.{0,100}?A.{0,100}?C.{0,100}?E.{0,100}?1.{0,100}?1.{0,100}?8.{0,100}?C.{0,100}?8.{0,100}?2.{0,100}?0.{0,100}?0.{0,100}?A.{0,100}?A.{0,100}?0.{0,100}?0.{0,100}?4.{0,100}?B.{0,100}?A.{0,100}?9.{0,100}?0.{0,100}?B/si
MiscreantPunch.EvilRTF.CVE-2017-0199.CommonStruct.9;Engine:81-255,Target:0;(0&1&2&3&4&5&6&7&8);0:7B5C7274;5c6f626a6563745c6f626a656d625c6f626a7570646174655c::i;456e61626c6520::i;45646974696e67::i;76696577207468697320646f63756d656e74::i;636c61737320576f72642e446f63756d656e742e::i;6530::i;6/class Word\.Document\.\d{3}/i;7/E0.{0,100}?C9.{0,100}?EA.{0,100}?79.{0,100}?F9.{0,100}?BA.{0,100}?CE.{0,100}?11.{0,100}?8C.{0,100}?82.{0,100}?00.{0,100}?AA.{0,100}?00.{0,100}?4B.{0,100}?A9.{0,100}?0B/si
MiscreantPunch.EvilRTF.CommonLure;Engine:81-255,Target:0;(0&(1|2));0:7b5c7274*456e61626c652045646974696e67::i;5c6f626a656d62;5c6f626a6c696e6b
MiscreantPunch.OleNativePackageEXEExt.InsideOLE.M2;Target:2;(0&1&2);006c006500310030004e00610074006900760065;000200;1/\x00\x02\x00\x00\x20*(?:[a-z]\x3a\x5c|\x5c\x5c|\x2f)[^\x00]*\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\x00\x00\x00\x03\x00.{4}\x20*(?:[a-z]\x3a\x5c|\x5c\x5c|\x2f)[^\x00]*\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\x00/si
MiscreantPunch.EvilMacro.WSDL.170609;Engine:81-255,Target:2;(0&1&2>3&3>=2&4&5&6&7>=2);4174747269627574652056425f::i;496620{3-20}2e537461747573203c3e20323030205468656e::i;4372656174654f626a65637428::i;203d205265706c61636528::i;203d2053706c697428::i;4c6f63616c42726f77736572::i;2e456e7669726f6e6d656e7428::i;52657061636b4f4b
MiscreantPunch.EvilRTF.CVE-2017-0199.CommonStruct.10;Engine:81-255,Target:0;(0&1);0:7b5c7274*456e61626c652045646974696e67::i;4530433945413739463942414345313138433832303041413030344241393042::i
MiscreantPunch.EvilDoc.Hancitor.170614;Engine:81-255,Target:2;(0&1&2);215052544557;4d6163726f73::w;5c564245(36|37)2e444c4c::i
MiscreantPunch.EvilMacro.MultiPSDL.170615;Engine:81-255,Target:2;(0&1&2>10&3&4&5>=2&6);4174747269627574652056425f;203d2022284e65772d4f626a;202b20;(27|25)(27|54)4d50255c{3-15}2e657865::i;2f63::i;2e657865(22|27)::i;2/\s*(?P<var>[a-z]{3,15})\s*\.\s*[a-z]{3,10}\s*\+\s*(?P=var)\s*\.\s*[a-z]{3,10}\s*\+\s*(?P=var)\s*\.\s*[a-z]{3,10}\s*\+/si
MiscreantPunch.EvilMacro.MultiPSDL.170616;Engine:81-255,Target:2;(0&1&2&3&4&5&6>25);4174747269627574652056425f;203d2022634739335a584a7a;417456326c755a47393355335235;4943523363324e7961584230;5a4739744f795231636d787a49443067;54324a715a574e304946645459334a70634851755532686c6247;203d2022
MiscreantPunch.EvilMacro.MultiPSDL.170619;Engine:81-255,Target:2;(0&1&2>10&3>10&4>4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f;456e7669726f6e;43616c6c42794e616d65;56624d6574686f64;20262043616c6c42794e616d6528;4765744f626a6563742843616c6c42794e616d6528;4368722428417363284d69642428;53686f7757696e646f77203d2030;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170619;Engine:81-255,Target:2;(0&1&2>100&3&4&5&6&7>25&8>25&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f;5269676874284c65667428::i;54696d65722829::i;4a6f696e28417272617928::i;203d205368656c6c28::i;53747252657665727365::i;202b2043687228::i;202b20;202620;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M3.170619;Engine:81-255,Target:2;(0&1&2&3);4174747269627574652056425f;203d204372656174654f626a6563742822575363726970742e5368656c6c2229::i;5c62696e5c44656275675c{3-20}2e65786522::i;2e52756e2028{3-20}290d0a456e6420537562::i
MiscreantPunch.EvilMacro.MultiPSDL.M4.170619;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f::i;203d2053706c697428::i;203d204a6f696e28::i;203d2022::i;4170706c69636174696f6e2e52756e::i;43687228::i;53706c6974285472696d28::i;417272617928::i;5368656c6c::i;3/\s*=\s*[\x22\x27](?:[0-9]{2,3}[^0-9]){100,}[0-9]{2,3}\s*[\x22\x27]/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.WSDL.170619;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8>100&9>100&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;4372656174654f626a656374::i;536372697074696e672e46696c6553797374656d4f626a656374::i;4765745370656369616c466f6c646572::i;4f70656e5465787446696c6528::i;2e74787422::i;2e52656164416c6c2829::i;2e5772697465::i;2e57726974654c696e652028::i;5265706c6163652822::i;205642412e4372656174654f626a65637428::i;2e52756e::i;5773{3-5}6372{3-5}6970{3-5}742e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170620;Engine:81-255,Target:2;(0&1&2&(3|4)&5&6&7>25);4174747269627574652056425f::i;203d2022634739335a(58|7c584a7a);417456326c755a4739;4943523363324e7961584230;4943526c626e593664475674634341;5a4739744f;54324a715a574e304946645459334a;203d20
MiscreantPunch.EvilMacro.MultiPSDL.170620;Engine:81-255,Target:2;(0&1&(2|3|4)&5&(6|7|8)&(9|10));4174747269627574652056425f::i;5368656c6c::i;203d20226322::i;203d2022636d22::i;203d2022636d6422::i;2f632022202b20::i;4e65772d4f626a656374::i;4e65742e576562436c69656e74::i;2d50726f63657373::i;25544d50255c{3-15}2e65786527::i;2554454d50255c{3-15}2e65786527::i
MiscreantPunch.EvilMacro.PSDL.170622;Engine:81-255,Target:2;(0&1>200&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;43616c6c20::i;(52756e|5368656c6c)28416374697665446f63756d656e742e4275696c74496e::i;766248696465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170626;Engine:81-255,Target:2;(0&1&2>5&3>5&4>=4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;456e7669726f6e::i;43616c6c42794e616d65::i;56624d6574686f64::i;20262043616c6c42794e616d6528::i;5368656c6c::i;4368722428417363284d69642428::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.XPSEvade.170627;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;526563656e7446696c65732e436f756e74::i;2e456e7669726f6e28::i;496620496e53747228{1-5}2c20(22|27)585053(22|27)2c204163746976655072696e7465722920(3c|3e|3c3e|3d3c|3e3d)20{1-3}205468656e::i;43616c6c42794e616d65::i;43687228::i;766248696464656e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilEXE.NotPetya;Engine:81-255,Target:0;(0&1&2&3&4&5);0:4d5a;43484b44534b20697320726570616972696e6720736563746f72::i;506c65617365207265626f6f7420796f757220636f6d707574657221::i;44656372797074696e6720736563746f72::i;524541444d452e545854::iw;53656e6420796f757220426974636f696e2077616c6c657420494420616e6420706572736f6e616c20696e7374616c6c6174696f6e206b657920746f20652d6d61696c::i
MiscreantPunch.EvilMacro.DocDropper.170629;Engine:81-255,Target:2;(0&1&2>10&3&4&5&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;205265706c61636528::i;2043687228::i;2e416464436f6465::i;2e52756e::i;2e4c616e6775616765::i;43616c6c::i;456e7669726f6e28::i;2e4c616e6775616765203d20{3-20}2822::i;8/V[^B]*B[^S]*c[^c]*r[^i]*i[^p]*t[^\x22\x27]*[\x22\x27]\s*\)/si;2822::i;10/W[^s]*s[^c]*c[^r]*r[^i]*i[^p]*p[^t]*t[^\.]*\.[^S]*S[^h]*h[^e]*e[^l]*l[^\x22\x27]*[\x22\x27]/si;10/A[^d]*d[^o]*o[^d]*d[^b]*b[^\.]*\.[^S]*S[^t]*t[^r]*r[^e]*e[^a]*a[^m]*m[^\x22\x27]*[\x22\x27]/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170630;Engine:81-255,Target:2;(0&1>75&2&3&4&5&6>25&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;43616c6c20::i;456e7669726f6e::i;2e65786522::i;5368656c6c::i;4f70656e20{3-20}2042696e6172792041636365737320526561642057726974652041732023::i;203d20417272617928::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M2.170630;Engine:81-255,Target:2;(0&1&2>25&3>25&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;456e642053656c656374::i;53656c6563742043617365::i;43617365202d::i;1/\s+(?P<var>[A-Za-z0-9]{3,20})\s*=\s*[0-9\-]{1,6}\s*[\+\-\\\*]\s*[0-9\-]{1,6}\s+Select\s*Case\s*(?P=var)/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M3.170630;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;55426f756e6428::i;20262043687228::i;203d2053706c697428::i;3/\s*[\x22\x27](?:[^\x20]{1,2}\x20){50,}[^\x20][\x22\x27]/si;4170706c69636174696f6e2e52756e::i;43616c6c205368656c6c28::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.JSDL.170630;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8>150&9>150&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;4372656174654f626a656374::i;536372697074696e672e46696c6553797374656d4f626a656374::i;2e6a7322::i;4765745370656369616c466f6c646572::i;4f70656e5465787446696c6528::i;2e74787422::i;2e52656164416c6c2829::i;2e5772697465::i;2e57726974654c696e652028::i;5265706c61636528::i;205642412e4372656174654f626a65637428::i;2e52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170705;Engine:81-255,Target:2;(0&1&2&3>10&4&5&6&7&8&9&10&11);4174747269627574652056425f::i;203d204372656174654f626a65637428::i;203d2043687228::i;2920262043687228::i;203d20456e7669726f6e28::i;2e73656e64::i;2e54797065203d20::i;2e4f70656e::i;2e7772697465::i;2e726573706f6e7365426f6479::i;2e637265617465456c656d656e742843687228::i;44696d20{40-60}20417320537472696e670d0a44696d20{40-60}204173204f626a6563740d0a44696d20{40-60}20417320537472696e670d0a44696d20{40-60}204173204f626a656374::i
MiscreantPunch.EvilMacro.MultiPSDL.M3.170705;Engine:81-255,Target:2;(0&1&2&3&4>10&5>10&6>1&7&8>100&9>5&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f::i;20222f22202b2022632022::i;496e766f6b652d45787072657373696f6e::i;68747470::i;203d204172726179284e6f772829::i;4d696e757465284e6f7729::i;43687228::i;3d205368656c6c::i;4e6f772829::i;54696d65722829::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.M4.170705;Engine:81-255,Target:2;(0&1&2&3&4&5>10&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;53706c697428::i;55426f756e6428::i;3d204368722428::i;417363284d696428::i;20262022;4170706c69636174696f6e2e52756e28::i;5265706c61636528::i;5368656c6c::i;203d20;9/\s*(?P<var>[A-Za-z0-9]{3,15})\s*&\s*[\x22\x27][A-F0-9\(\)]{25,}\s*[\x22\x27]\s+(?P=var)\s*=\s*(?P=var)\s*&\s*[\x22\x27][A-F0-9]{25,}\s*[\x22\x27]\s+(?P=var)\s*=\s*(?P=var)\s*&\s*[\x22\x27][A-F0-9]{25,}\s*[\x22\x27]/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.MaliciousRedirAdGholas.20170705;Engine:81-255,Target:3;(0&1&2&3&4&5&6&7);3b766172623d64;742e617070656e646368696c642862293b64;622e7374796c655b6b5d3d6273;666f72287661726b696e6273;745b6b5d3d61;625b6b5d3d62;28646f63756d656e742e626f6479293b7d3b696628646f63756d656e742e626f647929;2e637265617465656c656d656e742822696d6722293b666f72287661726b696e62
#MiscreantPunch.Office.SMB.AuthLeak.LinkToNonRFC1918DottedQuad;Engine:81-255,Container:CL_TYPE_ZIP,Target:7;(0&1);72656c6174696f6e73686970;0/\<relationship(?=[^>]*TargetMode\s*=\s*\x22External\x22)(?=[^>]*Type\s*=\s*\x22[^\x22]+template)[^>]*Target\s*=\s*\x22(?:file\:)?(?:\x2f+(?:\\\\)?|\\\\)(?!(?:10|192\.168|172\.(?:1[6-9]|2[0-9]|3[0-1])\.))\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[\x2f\x5c]/si
MiscreantPunch.EvilMacro.XODAO20170708;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));584f5244656372797074696f6e::i;446563537472696e67::i;43616c6c42794e616d65::i;486578546f42797465734172726179::i;537472436f6e76::i;222648222026::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilPDF.CommonExploitStrings;Engine:81-255,Container:CL_TYPE_PDF,Target:7;(0&1&2&3&4);726f70;7368656c6c636f6465;686561707370726179;756e657363617065;257530633063(22|27)
MiscreantPunch.EvilMacro.PowershellB64.20170710;Target:2;(0&1&(2|3)>20);(22|27)634739335a584a7a614756;4174747269627574652056425f;44696d;4172726179
MiscreantPunch.LNK.CMDWSCRIPTADJSCRIPT;Engine:81-255,Target:0;(0);4c0000000114020000000000C000000000000046*002e0041006300740069007600650044006f00630075006d0065006e0074002e*0077007300630072006900700074*002f0062*0065003a006a007300630072006900700074::i
MiscreantPunch.EvilMacro.AORRSHEL20170713;Engine:81-255,Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23)&24);4170706c69636174696f6e2e52756e::i;5368656c6c::i;3d205265706c616365::i;3d2053706c6974::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;2/=\s*Replace\s*\(\s*(?P<varn>[A-Za-z0-9_-]+)\s*,.{0,500}\bShell\s*?Replace\(\s*(?P=varn)\s*,\s*[\x22\x27][^\x22\x27]{4,}[\x22\x27]/si
MiscreantPunch.EvilDoc.Hancitor.170717;Engine:81-255,Target:2;(0&1&2);214d494c4b4f;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilMacro.MultiPSDL.170718;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f;4f6e204572726f7220526573756d65204e657874;22203d2022;22205468656e;49662022;4/[A-Za-z]{30,60}\x22\s*=\s*\x22[A-Za-z]{30,60}\x22\s*Then\s+Dim\s*[A-Za-z]{30,60}\s*As\s+(?:Boolean|Integer|Object)\s+ElseIf\s*\x22[A-Za-z]{30,60}\x22\s*=\s*\x22[A-Za-z]{30,60}\x22\s*Then\s*Dim\s*[A-Za-z]{30,60}\s*As\s+(?:Boolean|Integer|Object)\s+End\s*If/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-0199.CommonConstruct.M11;Engine:81-255,Target:0;(0&1&2);0:7b5c7274;5c6f626a757064617465::i;3030303030303031303030303030303030303030303030303030303030303030303030303030613430303030303065306339656137396639626163653131386338323030616130303462613930623863303030303030::i
MiscreantPunch.EvilMacro.MultiDL.170720;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;75726c6d6f6e::i;5368656c6c4578656375746557::i;7368656c6c3332::i;4c696220226b65726e656c33322220416c69617320224c6f61644c6962726172794122::i;4c696220226b65526e654c33322e646c6c2220416c696173202247657450726f634164647265737322::i;4c696220224f4c4541757433322e646c6c2220416c69617320224469737043616c6c46756e6322::i;28456e7669726f6e242822415050444154412229::i;2e6578652229::i;4170706c69636174696f6e2e52756e::i;5265706c6163652822687474703a2f2f22::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.JSDL.170720;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;5368656c6c::i;6d73687461206a617661736372697074::i;52756e48544d4c4170706c69636174696f6e::i;646f63756d656e742e77726974652829::i;4765744f626a65637428::i;687474703a2f2f::i;4578656328::i;636c6f73652829::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170720;Engine:81-255,Target:2;(0&1>800&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f;43616c6c;43616c6c20;2/Call\s+(?P<var1>[a-z]{10,25})\s+End\s+(?:Sub|Function)\s+(?:Static|Private)?\s*(?:Function|Sub)\s*(?P=var1)\s*(?:\([^\)]*\))?(?:\s*As\s*(?:Double|Currency|Integer|String|Single|Variant|Date|Byte|Boolean|Object|Variant))?\s+Call\s*(?P<var2>[a-z]{10,20})\s+End\s+(?:Function|Sub)\s+(?:Static|Private)?\s*(?:Function|Sub)\s*(?P=var2)\s*(?:\([^\)]*\))?(?:\s*As\s*(?:Double|Currency|Integer|String|Single|Variant|Date|Byte|Boolean|Object|Variant))?\s+Call\s*(?P<var3>[a-z]{10,20})\s+End\s+(?:Function|Sub)\s+(?:Static|Private)?\s*(?:Function|Sub)\s*(?P=var3)\s*(?:\([^\)]*\))?(?:\s*As\s*(?:Double|Currency|Integer|String|Single|Variant|Date|Byte|Boolean|Object|Variant))?/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiDL.170721;Engine:81-255,Target:2;(0&1>3&2&3&4&5&6&7&8&9&10&11&12&13&(14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33));4174747269627574652056425f::i;4372656174654f626a65637428::i;6d6963726f736f66742e786d6c68747470::i;2e416464::i;4372656174654f626a6563742822575343524950542e5348454c4c2229::i;456e7669726f6e2822746d702229::i;2e4f70656e202247455422::i;2e73656e64::i;2e726573706f6e7365426f6479::i;2e537461747573203d20323030::i;4372656174654f626a656374282261646f64622e73747265616d2229::i;2e4f70656e::i;2e5772697465::i;2e53617665546f46696c65::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CommonObfus.20170723;Engine:81-255,Target:2;(0=0&(1|2)&3&4);575363726970742e5368656c6c::i;2757::i;2257::i;4174747269627574652056425f::i;(1|2)/[\x22\x27]W(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?S(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?c(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?r(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?i(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?p(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?t(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?\.(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?s(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?h(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?l(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?l/si
MiscreantPunch.EvilMacro.CommonObfusRunChrMathLR.20170725;Engine:81-255,Target:2;(0&(1|2)&3&4&5);436872::i;2e72756e::i;7368656c6c::i;417474726962757465205642::i;0/ChrW?\(\s*\d+\s*[\x2a\x2d\x2b\x2f\x5e\x25]\s*\d+\s*\)/si;(1|2)/(?:\.run|shell)\s*(?:\(\s*)?[A-Z0-9]{30}/si
MiscreantPunch.EvilRTF.SCTNewMoniker;Engine:81-255,Container:CL_TYPE_RTF,Target:2;(0&1&2);0000030300000000C000000000000046;0000030900000000C000000000000046;002e007300630074{1-2}ECABAFC67F1911D2978E0000F8757E2A::i
MiscreantPunch.EvilMacroAOPLIBXOR.20170726;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));436872::i;586f72::i;4e7457726974655669727475616c4d656d6f7279::i;4c6962::i;5669727475616c416c6c6f63::i;416c696173::i;53706c6974::i;537472436f6e7628537472436f6e76::i;417363284d6964::i;417474726962757465205642::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.CVE-2017-0199.CommonConstruct.M12;Engine:81-255,Target:2;(0&1);E0C9EA79F9BACE118C8200AA004BA90B;0/\xE0\xC9\xEA\x79\xF9\xBA\xCE\x11\x8C\x82\x00\xAA\x00\x4B\xA9\x0B\x44\x01\x00\x00(?=.{0,14}\x3a)(?:(?!\x00\x00).){14,275}\x00\x00\x00{50}/si
MiscreantPunch.EvilRTF.CommonConstruct.170727;Engine:81-255,Target:0;(0&1&2&3&4&5);0:7b5c7274::i;656e61626c65::fi;65646974696e67::fi;6f626a757064617465::i;576f72642e446f63756d656e742e::i;4/Word\.Document\.\d{3}/i
MiscreantPunch.EvilMacro.CHRCONHTTPEXEExec.170727;Engine:81-255,Target:2;(0&1&(2|3)&(4|5|6|7));436872283130342920(26|2b)20436872283131362920(26|2b)20436872283131362920(26|2b)204368722831313229::i;4368722834362920(26|2b)20436872283130312920(26|2b)20436872283132302920(26|2b)204368722831303129::i;417474726962757465205642::i;44696d20::i;2e72756e::i;7368656c6c::i;63726561746570726f63657373::i;2e65786563::i
MiscreantPunch.EvilMacro.PSNoPSComDec.170727;Engine:81-255,Target:2;((0|1)&2=0&3&(4|5|6|7));417474726962757465205642::i;44696d20::i;706f7765727368656c6c::i;6e65772d6f626a656374202d636f6d207368656c6c::i;2e72756e::i;7368656c6c::i;63726561746570726f63657373::i;2e65786563::i
MiscreantPunch.EvilMacro.MidMathEXECObufs.170727;Engine:81-255,Target:2;((0|1)&2&(3|4|5|6|7)&8);417474726962757465205642::i;44696d20::i;4d6964::i;2e72756e::i;7368656c6c::i;63726561746570726f63657373::i;2e65786563::i;637265617465746872656164::i;2/Mid\s*\(\s*[A-Z0-9a-z_-]+\s*,(?:\s*-?\d+\s*(?:[\x2a\x2d\x2b\x2f\x5e\x25]|x?or)\s*-?\d+\s*)+,\s*-?\d+\s*(?:[\x2a\x2d\x2b\x2f\x5e\x25]|x?or)\s*-?\d/si
MiscreantPunch.EvilMacro.ALTStreamM.170817;Engine:81-255,Target:2;(0);72000218003500000006000080a5000000cc0200005461686f6d61000000022000280000000d00008072756e646c6c33322e65786520*72ec0900007b020000000218003500000006000080a5000000cc0200005461686f6d610000000218002800000007000080*ec0900007b020000000218003500000006000080a5000000cc0200005461686f6d61
MiscreantPunch.EvilMacro.ALTStreamM.170727;Engine:81-255,Target:2;(0&1);00008072756e646c6c33322e65786520{3-10}ec0900007b020000000218003500000006000080a5000000cc0200005461686f6d610000000218002800000007;02000073657452657175657374486561646572000218003500000006000080a5000000cc0200005461686f6d61000000
MiscreantPunch.EvilMacro.CommonObfusFunc.20170728;Engine:81-255,Target:2;((0|1)&2&3&4&5&6);44696d20::i;417474726962757465205642::i;496e74284d6964::i;417363284d6964::i;436872::i;46756e6374696f6e::i;5/Function\s[^\r\n\x28]+\((?P<var1>[^\x29\x2c\s]+)[^\x29\x2c]*,\s*(?P<var2>[^\x29\x2c\s]+).+?For\s*(?P<var3>[A-Za-z0-9_-]+)\s*=\s*1\s*To\s*Len\s*\(\s*(?P=var1).*?&\s*Chr\$?\(\s*Asc\(\s*Mid\s*\(\s*(?P=var1)\s*,\s*(?P=var3)\s*,\s*\d+\s*\x29\s*\x29\s*-\s*Int\s*\(\s*Mid\s*\(\s*(?P=var2)\s*,/si
MiscreantPunch.EvilMacro.PSHELLCHR.170728;Engine:81-255,Target:2;((0|1)&2);436872{0-1}2831313229::i;436872{0-1}28383029::i;(0|1)/chr\$?\((?:112|80)\)\s*[&+]\s*chr\$?\((?:111|79)\)\s*[&+]\s*chr\$?\((?:119|87)\)\s*[&+]\s*chr\$?\((?:101|69)\)\s*[&+]\s*chr\$?\((?:114|82)\)\s*[&+]\s*chr\$?\((?:115|83)\)\s*[&+]\s*chr\$?\((?:104|72)\)\s*[&+]\s*chr\$?\((?:101|69)\)\s*[&+]\s*chr\$?\((?:108|76)\)\s*[&+]\s*chr\$?\((?:108|76)/si
MiscreantPunch.EvilMacro.AOPROPEXE.170731;Engine:81-255,Target:2;(0&(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20)&21);416374697665446f63756d656e742e437573746f6d446f63756d656e7450726f70657274696573::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;0/ActiveDocument.CustomDocumentProperties\s*\(\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s*\)\)\.Run\W/si
MiscreantPunch.EvilDL.170731;Engine:81-255,Target:2;(0&1&2>2&3&4&5&6&7&8&9&10&11);4174747269627574652056425f::i;557365722d4167656e74::i;203d204372656174654f626a65637428416c6572744e::i;203d205265706c616365285265706c61636528::i;2c2022{2-5}222c2022{2-4}22292c20::i;2e456e7669726f6e6d656e7428416c6572744e28::i;55426f756e64::i;43616c6c42794e616d65::i;56624d6574686f64::i;2e57726974652028::i;456e636f64696e672e41534349492e4765744279746573::i;2e537461747573203c3e2032303020::i
MiscreantPunch.EvilDoc.Hancitor.170801;Engine:81-255,Target:2;(0&1&2);214255524954;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilMacro.MultiPSDL.170801;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;44696d20{4-20}2041732056617269616e740d0a2020{4-20}203d204d6f64756c65312e::i;222c2022;2/[0-9]{100,}\x22/si;43616c6c205368656c6c28::i;766248696465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.Suspicious.RemoteTemplateCall;Engine:81-255,Container:CL_TYPE_ZIP,Target:7;(0&1&2&3);3c72656c6174696f6e73686970::i;7461726765746d6f6465::i;617474616368656474656d706c617465::i;0/\<relationship(?=(?:(?!\/>).)+?targetmode\s*=\s*[\x22\x27]?\s*external)(?=(?:(?!\/>).)+?type\s*=\s*[\x22\x27][^\x22\x27\s]+\/attachedtemplate)(?:(?!\/>).)+?target\s*=\s*[\x27\x22]?\s*(?:https?\x3a|ftp\x3a)/si
MiscreantPunch.EvilMacro.ShellDocProps.170801;Engine:81-255,Target:2;(0&1&2);417474726962757465205642::i;44696d20::i;5368656c6c28416374697665446f63756d656e742e4275696c74496e446f63756d656e7450726f70657274696573::i
#MiscreantPunch.EvilMacro.4LPMTHCHR;Engine:81-255,Target:2;(0&1&2);4174747269627574652056425f;466f72{1-500}546f{1-250}4c656e{1-250}436872{1-1000}4e657874::i;1/For\s[^\r\n]+To\s*Len(?:(?!\bNext\b).){1,1000}=[^\r\n]*?[&+]\s*?ChrW?\$?\s*?\x28\s*?(?:Asc\$?\x28(?:Mid\$?\x28[^\x29]+?\x29)?[^\x29]*?\x29)?[^\x29]*?\s(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor\b)/si
#MiscreantPunch.EvilMacro.PSDL.170802;Engine:81-255,Target:2;(0&1&2&3>4&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f;4372656174654f626a656374::i;416374697665446f63756d656e742e4275696c74496e446f63756d656e7450726f706572746965732822::i;416374697665446f63756d656e742e437573746f6d446f63756d656e7450726f7065727469657328::i;416374697665446f63756d656e742e437573746f6d446f63756d656e7450726f706572746965732822{1-}2229{1-}2e52756e24::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.ObfsPSDLGen.170804;Engine:81-255,Target:2;(0&1&(2|3)&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;227022202620226f22202620227722202620226522202620227222202620227322202620226822202620226522202620226c22202620226c22::i;225322202620226822202620226522202620226c22202620226c22::i;225722202620225322202620226322202620227222202620226922202620227022202620227422::i;4372656174654f626a65637428::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CRDTCHREXEMATH.170807;Engine:81-255,Target:2;(0&1&(2|3)&4);4372656174654f626a656374::i;2e4461746154797065*436872::i;5368656c6c::i;2e52756e::i;1/\.DataType\s*=\s*ChrW?\$?\s*?\x28\s*?(?:Asc\$?\x28(?:Mid\$?\x28[^\x29]+?\x29)?[^\x29]*?\x29)?[^\x29]*?\s(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor\b)[^\r\n]*?[&+][^\r\n]*?\bChrW?\$?\s*?\x28\s*?(?:Asc\$?\x28(?:Mid\$?\x28[^\x29]+?\x29)?[^\x29]*?\x29)?[^\x29]*?\s(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor\b)/si
#MiscreantPunch.EvilMacro.PShellObfus.170807;Engine:81-255,Target:2;((0|1)&((2|3)>3)&(4|5)&((6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51)>3));417474726962757465205642::i;44696d::i;2022202b::i;222026::i;7368656c6c::i;2e72756e::i;2d5e::i;2e5e::i;615e::i;635e::i;625e::i;655e::i;645e::i;665e::i;695e::i;685e::i;6c5e::i;6f5e::i;6e5e::i;705e::i;735e::i;725e::i;755e::i;745e::i;775e::i;795e::i;785e::i;5e2d::i;5e2e::i;5e61::i;5e63::i;5e62::i;5e65::i;5e64::i;5e66::i;5e69::i;5e68::i;5e6c::i;5e6f::i;5e6e::i;5e70::i;5e73::i;5e72::i;5e75::i;5e74::i;5e77::i;5e79::i;5e78::i;5e22::i;225e::i;225e::i;225e::i
MiscreantPunch.EvilMacro.PonyDL.170807;Engine:81-255,Target:2;(0&1&2&3&4&5);4174747269627574652056425f;5075626c6963204465636c61726520507472536166652046756e6374696f6e20{3-20}204c696220224b65726e656c33322e646c6c2220416c69617320224372656174654576656e74572220::i;5075626c6963204465636c61726520507472536166652046756e6374696f6e20{3-20}204c696220224b65726e656c33322220416c696173202243726561746554696d6572517565756554696d65722220::i;5642412e537472436f6e7628::i;416e642057696e3634;416e64204e6f742057696e3634
MiscreantPunch.EvilMacro.MultiPSDL.170807;Engine:81-255,Target:2;(0&1>20&2>100&(3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22));4174747269627574652056425f;5368656c6c::i;2026206368727728::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Hancitor.170807;Engine:81-255,Target:2;(0&1&2);215449485552;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilMacro.PSHELLB64.1;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;77543364;4/wT3d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.2;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;55473933;4/UG93(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
MiscreantPunch.EvilMacro.PSHELLB64.3;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;63473958;4/cG9X(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
MiscreantPunch.EvilMacro.PSHELLB64.4;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;77543164;4/wT1d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.5;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42505630;4/BPV0V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.6;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42505632;4/BPV2V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.7;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;77623164;4/wb1d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.8;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;77623364;4/wb3d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.9;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;55453958;4/UE9X(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
MiscreantPunch.EvilMacro.PSHELLB64.10;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;63453958;4/cE9X(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
MiscreantPunch.EvilMacro.PSHELLB64.11;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;51543164;4/QT1d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.12;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;51543364;4/QT3d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.13;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;63453933;4/cE93(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
MiscreantPunch.EvilMacro.PSHELLB64.14;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42506432;4/BPd2V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.15;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42506430;4/BPd0V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.16;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;51623364;4/Qb3d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.17;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42765632;4/BvV2V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.18;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;51623164;4/Qb1d(?:F(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))))|l(?:U(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))|c(?:lN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW]))|nN(?:I(?:R[UW]|Z[UW])|o(?:R[UW]|Z[UW])))))/
MiscreantPunch.EvilMacro.PSHELLB64.19;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42765630;4/BvV0V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.20;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42766430;4/Bvd0V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.21;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;42766432;4/Bvd2V(?:S(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb])))|y(?:U(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))|c(?:0h(?:F[Tb]|l[Tb])|2h(?:F[Tb]|l[Tb]))))/
MiscreantPunch.EvilMacro.PSHELLB64.22;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;63473933;4/cG93(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
MiscreantPunch.EvilMacro.PSHELLB64.23;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;55473958;4/UG9X(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
MiscreantPunch.EvilMacro.PSHELLB64.24;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;55453933;4/UE93(?:R(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))))|Z(?:VJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))|XJ(?:T(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms]))|z(?:S(?:EV[Ms]|GV[Ms])|a(?:EV[Ms]|GV[Ms])))))/
#MiscreantPunch.EvilMacro.MultiPSDL.170808;Engine:81-255,Target:2;(0&1&2>10&3&4>18&5&6>15&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f;5368656c6c::i;203d20417272617928::i;43687228::i;2b24::i;203d2043687228;4e6f77::i;5/\s*\(\s*Int\(?[^\\\+\-\*]+[\\\+\-\*]\s*[^\)]+\x29/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilRTF.CommonConstruct.170808;Engine:81-255,Target:0;(0&1&2&3&4&5&6);0:7b5c7274::i;5c6f626a656d62::i;5c6f626a757064617465::i;576f72642e446f63756d656e742e::i;6530::i;3/Word\.Document\.\d{3}/i;4/E0.{0,20}?C.{0,20}?9.{0,20}?E.{0,20}?A.{0,20}?7.{0,20}?9.{0,20}?F.{0,20}?9.{0,20}?B.{0,20}?A.{0,20}?C.{0,20}?E.{0,20}?1.{0,20}?1.{0,20}?8.{0,20}?C.{0,20}?8.{0,20}?2.{0,20}?00.{0,20}?A.{0,20}?A.{0,20}?0.{0,20}?0.{0,20}?4.{0,20}?B.{0,20}?A.{0,20}?9.{0,20}?0.{0,20}?B/si
#MiscreantPunch.EvilMacro.MultiPSDL.170808;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f;4372656174654f626a65637428::i;5368656c6c::i;53747252657665727365::i;2e52756e::i;4f70656e::i;726573706f6e7365626f6479::i;7772697465::i;586f72::i;53617665546f46696c65::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.Evil.PPTX.CVE-2017-8570;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1&2&3&4);3c52656c6174696f6e73686970::i;6f6c654f626a656374::i;5461726765744d6f6465::i;45787465726e616c::i;0/<Relationship(?=[^>]+Type\s*=\s*[\x22\x27]?[^\x22\x27\s]+\/relationships\/oleObject)(?=[^>]+Target\s*=\s*[\x22\x27]?script(?:let)?\x3a(?:https?|ftp))[^>]+TargetMode\s*=\s*[\x22\x27]?External/si
MiscreantPunch.EvilMacro.JSDL.170811;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;5368656c6c::i;6d73687461206a617661736372697074::i;6d7368746d6c::i;52756e48544d4c4170706c69636174696f6e::i;4765744f626a656374::i;7363726970743a687474703a2f::i;5265706c61636528::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Hancitor.1708014;Engine:81-255,Target:2;(0&1&2);214153485549;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilDoc.PSDL.ActiveDoc.170814;Engine:81-255,Target:2;(0|1|2)&(3|4|5);65774178414830416577417741483041;73414d514239414873414d41423941;37414445416651423741444141665141;4a774170414341414c5142444147384162514250414749416167426c41474d41644141674143674149674237;63414b5141674143304151774276414730415477426941476f415a51426a414851414941416f4143494165;6e41436b414941417441454d416277427441453841596742714147554159774230414341414b4141694148
MiscreantPunch.EvilMacro.MultiPSDL.M3.170814;Engine:81-255,Target:2;(4);4174747269627574652056425f::i;5075626c69632046756e6374696f6e::i;2e52756e::i;43616c6c205368656c6c::i;0&1&2&3/\s+[^\(]+?\((?P<var1>[a-z]{3,15})\s+As\s+String\s*\)\s+Call\s+[^\.]+\.Run\s*\(\s*[\x22\x27]\s*(?P<var2>[a-z]{3,15})\s*[\x22\x27],\s*(?P=var1)\s*\)\s+End\s+Function\s+Public\s+Function\s*(?P=var2)\s*\((?P<var3>[a-z]{3,15})\s*As\s+String\s*\)\s+Call\s+Shell\s*\((?P=var3),/si
#MiscreantPunch.EvilMacro.MultiPSDL.M2.170814;Engine:81-255,Target:2;(0&1&2&3&4&5>4&6&7&8&9&10&11&12&13>2);4174747269627574652056425f::i;203d20226322::i;203d20226d22::i;203d20226422::i;203d20222e22::i;203d20226522::i;203d20227822::i;203d20227022::i;203d20226f22::i;203d20227722::i;203d20227222::i;203d20227322::i;203d20226822::i;3d20226c22::i
MiscreantPunch.EvilMacro.MultiPSDL.1700814;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;416374697665446f63756d656e742e::i;203d20537472436f6e7628::i;203d2053706c697428::i;537472436f6e7628537472436f6e7628::i;5368656c6c::i;43687228::i;586f72::i;417363284d696424::i;44696d::i;9/\s*(?P<var>[A-Za-z0-9]{10,30})\s+(?P=var)\s*=\s*Split\s*\(/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.LNK.WMIMSHTAJS;Engine:81-255,Target:0;(0);4c0000000114020000000000c000000000000046*57004d00490043002e00650078006500*6d007300680074006100*6a006100760061007300630072006900700074003a006500760061006c00*53007400720069006e0067002e00660072006f006d00430068006100720043006f00640065002800::i
MiscreantPunch.EvilMacro.MultiPSDL.M4.160814;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&11&(12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31));4174747269627574652056425f::i;4372656174654f626a65637428::i;6d6963726f736f66742e786d6c68747470::i;456e7669726f6e2822746d702229::i;2e4f70656e::i;2e53656e64::i;474554::i;61646f64622e73747265616d::i;2e5772697465::i;2e53617665546f46696c65::i;5368656c6c::i;766248696465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.WinMac.170815;Engine:81-255,Target:2;(0&1&(2|3)&(4|5|6)&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f::i;46756e6374696f6e2073797374656d204c696220226c6962632e64796c696222::i;234966204d6163::i;234966204f5358::i;2349662057696e3332::i;2349662057696e3634::i;23456c7365::i;5368656c6c::i;6563686f::i;707974686f6e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170816;Engine:81-255,Target:2;(0&1&2&3&4);4174747269627574652056425f::i;496620{2-20}203d20{1-3}205468656e20{2-20}203d204368722428::i;5368656c6c::i;46756e6374696f6e::i;3/Dim\s*(?P<var>[a-z]{3,20})\s*\(\s*\)\s+.+(?P=var)\s*=\s*[\x22\x27][^\x22\x27]{50,200}[\x22\x27]\s+(?P=var)\s*=\s*(?P=var)\s*\+\s*[\x22\x27][^\x22\x27]{50,200}[\x22\x27]\s+/si
MiscreantPunch.EvilMacro.REGSRVDL.170816;Engine:81-255,Target:2;(0&1&2&3&(4|5|6)&(7|8)&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4372656174654f626a65637428::i;575363726970742e5368656c6c::i;2e52756e{1-10}28(22|27)7265677376723332::i;2f73::i;2f6e::i;2f75::i;2e646c6c::i;2e657865::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170816;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7>30&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;2349662056424137205468656e::i;46756e6374696f6e20{3-25}204c696220227553457233322220416c69617320224765744465736b746f7057696e646f7722::i;4c696220226b45726e456c33322220416c696173202252746c4d6f76654d656d6f727922::i;46756e6374696f6e20{3-25}204c696220226b45726e456c33322220416c69617320224865617043726561746522::i;23456c7365::i;23456e64204966::i;43616c6c20::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Hancitor.1708016;Engine:81-255,Target:2;(0&1&2);214c4b535745;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
MiscreantPunch.EvilDoc.Hancitor.1708017;Engine:81-255,Target:2;(0&1&2);214f50535254;4d6163726f73::w;5c564245(36|37)2e444c4c::iw
#mostly pulled from github.com/pan-unit42/public_tools/blob/master/hancitor/hancitor_dropper.yar
MiscreantPunch.EvilMacro.Hancitor.170817;Engine:81-255,FileSize:100-1000000,Target:2;(0&(1|2|3|4)&(5|6|7)&(8|9|10|11|12|13|14|15|16|17)&(18|19));0:D0CF11E0;5669727475616c416c6c6f63;48656170416c6c6f63;48656170437265617465;416c6c6f636174655669727475616c4d656d6f7279;52746c4d6f76654d656d6f7279;577269746550726f636573734d656d6f7279;57726974655669727475616c4d656d6f7279;43616c6c57696e646f7750726f63;456e756d5265736f757263655479706573;456e756d53797374656d4c616e677561676547726f757073;456e756d55494c616e677561676573;456e756d44617465466f726d617473;456e756d43616c656e646172496e666f;456e756d54696d65466f726d617473;5348437265617465546872656164;47726179537472696e67;43726561746554696d6572517565756554696d6572;49454e44ae426082{4-8}0800;0101063f007fffd9{4-8}0800
MiscreantPunch.PSHELLCHRFEQCNTEXE.170818;Engine:81-255,Target:2;((0|1)&(2|3)&(4|5)&((6|7)>1)&(8|9)&(10|11)&(12|13)&((14|15)>1)&(16|17|18|19|20|21));636872{0-2}2831313229::i;636872{0-2}28383029::i;636872{0-2}2831313129::i;636872{0-2}28373929::i;636872{0-2}2831313929::i;636872{0-2}28383729::i;636872{0-2}2831303129::i;636872{0-2}28363929::i;636872{0-2}2831313429::i;636872{0-2}28383229::i;636872{0-2}2831313529::i;636872{0-2}28383329::i;636872{0-2}2831303429::i;636872{0-2}28373229::i;636872{0-2}2831303829::i;636872{0-2}28373629::i;2e72756e::i;7368656c6c::fi;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i
#MiscreantPunch.EvilMacro.4LPMTHCHRv2;Engine:81-255,Target:2;(0&1&2&3=0&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19));4174747269627574652056425f;466f72{1-500}546f{1-250}4c656e{1-250}436872{1-1000}4e657874::i;1/For\s[^\r\n]+To\s*Len(?:(?!\bNext\b).){1,1000}=[^\r\n]*?[&+]\s*?ChrW?\$?\s*?\x28\s*?(?:Asc\$?\x28(?:Mid\$?\x28[^\x29]+?\x29)?[^\x29]*?\x29)?[^\x29]*?\s(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor\b)/si;28434c6e6728;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;5368656c6c45786563757465::i;53747252657665727365::i;43616c6c42794e616d65::i;3d20496e74284d696428::i;4368722428417363284d6964::i;6f70656e70726f63657373::i;77696e33325f70726f63657373::i;6b65726e656c3332::i;7368656c6c3332::i;6e74646c6c::i
MiscreantPunch.EvilMacro.PSDL.170818;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;43687228::i;203d2053706c697428::i;2/[\x22\x27]\s*(?:[0-9]{2,3}\s){100,}[0-9]{2,3}\s*[\x22\x27]\s*,[^\)]+\)\s+/si;43616c6c::i;2e52756e::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170818;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8>2&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;416374697665576f726b626f6f6b2e46756c6c4e616d65::i;203d20537472436f6e7628::i;203d204d69642428::i;4c656e::i;5368656c6c::i;20466f722042696e61727920416363657373205265616420417320::i;43687228::i;5f4f70656e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.M2.180818;Engine:81-255,Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;5075626c69632046756e6374696f6e20{20-70}4d6f64756c65312e::i;1/[^,]+,\s*[\x22\x27][0-9]{100,}[\x22\x27]/si;4170706c69636174696f6e2e52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PVDISABLE.170819;Engine:81-255,Target:2;((0|1)&2&3&(4|5|6|7)&8);44696d20::i;417474726962757465205642::i;4372656174654f626a656374::i;2e5265675772697465::i;5c5642415761726e696e6773::i;5c44697361626c65496e7465726e657446696c6573496e5056::i;5c44697361626c65417474616368656d656e7473496e5056::i;5c44697361626c65556e736166654c6f636174696f6e73496e5056::i;5245475f44574f5244::i
MiscreantPunch.EvilMacro.PSDL.M2.170821;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;5368656c6c::i;203d20227022202b20::i;202b2043687228::i;203d20::i;4/ChrW?\$?\s*?\x28\s*?(?:Asc\$?\x28(?:Mid\$?\x28[^\x29]+?\x29)?[^\x29]*?\x29)?[^\x29]*?\s(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor\b)/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.GenDL.170821;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4372656174654f626a65637428224d6963726f736f66742e584d::i;4372656174654f626a656374282241646f64622e53747265616d2229::i;2e4f70656e::i;2e53656e64::i;2e65786522::i;2e5772697465::i;2e726573706f6e7365426f6479::i;5368656c6c2028(22|27){1-25}2e657865(22|27)29::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MelissaVirus;Engine:81-255,Target:2;(0);574f52442f4d656c69737361207772697474656e206279204b77796a69626f::i
MiscreantPunch.EvilMacro.PSDL.170821;Engine:81-255,Target:2;(0&1&2&3>5&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;5368656c6c::i;417272617928::i;4e6f772829::i;203d20::i;4/[\x22\x27]p(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?w(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?h(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l/si;53747252657665727365::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.OleNativePackageEXEExt.SSPLIT.M3.InsideOLE;Target:2;(0&1&2&3&4);006c006500310030004e00610074006900760065;000200;0000000300;1/\x00\x02\x00[^\x00]+\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\x00(?:[a-z]\x3a\x5c|\x5c\x5c)/si;2/\x00\x00\x00\x03\x00.{4}(?:[a-z]\x3a\x5c|\x5c\x5c)[^\x00]*\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\x00/si
MiscreantPunch.EvilMacro.PSDL.170824;Engine:81-255,Target:2;(0&1&2&3&4>75&5&6&7&8&9&10&11&(12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31));4174747269627574652056425f::i;4372656174654f626a65637428224d6963726f736f66742e58::i;2e637265617465456c656d656e7428::i;2e4461746154797065203d202262696e2e68657822::i;20262022;53797374656d2e494f2e4d656d6f727953747265616d::i;53797374656d2e52756e74696d652e53657269616c697a6174696f6e2e466f726d6174746572732e42696e6172792e42696e617279466f726d6174746572::i;2253797374656d2e436f6c6c656374696f6e732e41727261794c697374::i;2e577269746542797465::i;2e44796e616d6963496e766f6b6528::i;2e437265617465496e7374616e636528::i;2e52756e50726f6365737328::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.SWF.SunDownGF.08252017;Engine:81-255,Target:11;(0&1&2&3&4&5&6&7);d0302085d6{0-100}2c01d7240063042400630410{0-100}09d162042402a246{0-100}0146{0-100}00d162042402a22401a046{0-100}00a085d62c{0-100}d2a085d6{0-100}d360015d{0-100}d246{0-100}0146{0-100}a085d7c2046204d166{0-100}2402a315{0-100}ffffd348;d0305d{0-40}0080{0-40}d2d15d{0-40}004f{0-40}d24f{0-40}0147;d0305d{0-40}0080{0-40}d2d15d{0-40}004f{0-40}d24f{0-40}0147;023078::i;3361::i;55524c52657175657374::i;4c6f61646572436f6e74657874::i;66726f6d43686172436f6465::i
MiscreantPunch.EvilMacro.SICPSCN.170828;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;2e56425f50726f63446174612e56425f496e766f6b655f46756e63::i;2e436f7079::i;4372656174654f626a65637428225368656c6c2e4170706c69636174696f6e22292e4e616d65737061636528{3-35}292e53656c662e496e766f6b655665726220(22|27)5061737465(22|27)::i;43616c6c205368656c6c28::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170829;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;203d20525472696d::i;1/\s*\(\s*[\x22\x27]\s*(?=[1-3]{0,99}0)(?=[02-3]{0,99}1)(?=[0-13]{0,99}2)(?=[0-2]{0,99}3)[0-3]{100,}[\x22\x27]\s*\)\s+Call/si;43616c6c::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.Evilmacro.PSDL.M2.170829;Engine:81-255,Target:2;(0&1&2&(3|4|5|6|7|8)&9>5);4174747269627574652056425f::i;46756e6374696f6e2043726561746546696c65204c696220226b65726e656c33322220416c696173202243726561746546696c654122::i;46756e6374696f6e20577269746546696c65204c696220226b65726e656c333222::i;(22|27)54566f41::i;(22|27)54567042::i;(22|27)54567051::i;(22|27)54567141::i;(22|27)54567151::i;(22|27)5456726f::i;202b20
MiscreantPunch.EvilMacro.GenB64ArrayBuildStruct;Engine:81-255,Target:2;(2&(3|4));4174747269627574652056425f::i;44696d::i;0&1/\s*(?P<var>[A-Za-z0-9]{2,25})\s+(?:(?P=var)\s*=\s*[\x22\x27]\s*[A-Za-z0-9\/\+]{15,}\s*[\x22\x27]\s+)?(?:(?P=var)\s*=\s*(?P=var)\s*[\+&]\s*[\x22\x27][A-Za-z0-9\/\+]{50,}[\x22\x27]\s+)+/si;5368656c6c::i;2e52756e::i
MiscreantPunch.RTF.2017-0199.Obfus.170830;Engine:81-255,Target:0;(0&1&2&(3|4|5));0:7b5c727466!(315c);0/^\{\x5crtf[^\s\x5c1]/s;5c6f626a757064617465;5c6f626a656d62;5c6f626a6175746c696e6b;5c6f626a6c696e6b
MiscreantPunch.EvilMacro.PSDL.170830;Engine:81-255,Target:2;(0&1&2&3>10&4>50&5&6&7>20&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;2f63::i;4172726179284e6f7728::i;(27|22)3b24;4e756c6c::i;202b2043687228::i;5368656c6c::i;284e6f77::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170831;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;46756e6374696f6e2047657450726f6341646472657373204c696220226b65726e656c333222::i;3d205368656c6c28{3-25}2c2076624869646529::i;5772697465546578742028(27|22){1-25}(27|22)2920262043687228????29::i;3d20537472436f6e7628{3-25}2c207662556e69636f646529::i;586f72::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.DropBoxLockyDLCredPHISH;Engine:81-255,Target:3;(0&1&2&3&4);3c7469746c65*64726f70626f78::i;64726f70626f78206163636f756e74206d61746368696e67207468617420656d61696c::i;3c61*73656e642d656d61696c2d6c696e6b::i;0/<title(?:(?!<\/title>).)+?dropbox/si;2/<a(?=(?:(?!<\/a>).)+?href\s*=\s*[\x22\x27]https?\:\/\/(?!dropbox\.com\/)(?![^\x2f]+\.dropbox\.com\/)[^\x22\x27]+\.php)(?:(?!<\/a>).)+?id\s*=\s*[\x22\x27]send-email-link/si
MiscreantPunch.EvilMacro.PSDL.170901;Engine:81-255,Target:2;(0&1&2&3&4);4174747269627574652056425f::i;466f72::i;1/\s*\w{1,25}\s*=\s*1\s*To\s+Len\s*\([^\)]+\)\s+(?P<var>[a-z0-9]{1,25})\s*=\s*(?P=var)\s*\+\s*getCharReverse\(Mid\([^\)]+\)\s*,\s*[^\)]+\)\s+Next\s*/si;5368656c6c::i;6765744368617252657665727365284d696428::i
MiscreantPunch.EvilMacro.ALTB64STR.170905;Engine:81-255,Target:2;(0&1&2);44696d20::i;4174747269627574652056425f::i;4b58552f79503d423239744c7a6964714e5275662d536256496e77306f43726d575a6b364f704663374135475444315178614a33483868346a4d65457359676c76::i
MiscreantPunch.EvilMacro.ALTB64STR.M2.170905;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12)&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));313529202a20313629::i;3329202a20363429::i;205c203136::i;205c2034::i;57696e33325f50726f636573736f72::i;457870616e64456e7669726f6e6d656e74537472696e6773::i;2554454d5025::i;636d64202f63::i;5075742023::i;4372656174654f626a656374::i;42696e617279::i;7368656c6c::i;2e72756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170905;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f::i;4372656174654f626a6563742822575363726970742e5368656c6c2229::i;2e52756e::i;2e53706c697428::i;2e657865::i;53746172742d50726f63657373::i;2d57696e646f775374796c652048696464656e::i;4e65742e576562436c69656e74::i;446f776e6c6f616446696c65::i;5772697465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.DTSTRREVCHREXE.170905;Engine:81-255,Target:2;((0|1)&2&3&4&(5|6)&7);4174747269627574652056425f::i;44696d20::i;2e4461546154597045::i;53747252657665727365::i;436872::i;7368656c6c::i;2e72756e::i;2/.datatype\s*=\s*strreverse\s*\(\s*chrw?\$?\s*\(/si
MiscreantPunch.EvilMacro.PSDL.170906;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4372656174654f626a6563742822575363726970742e5368656c6c2229::i;2e52756e::i;203d20;3/[\x22\x27]p(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?w(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?h(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.LockyJS.170906;Engine:81-255,Target:7;(0&1&2&3);726573706f6e7365626f6479::i;73617665746f66696c65::i;66756e6374696f6e*6e6577*616374697665786f626a656374*72657475726e::i;2/function.{0,1000}?\b(?P<funcdec>[A-Za-z0-9_-]{1,1000})\s*=\s*new\s+activexobject\s*\(.*?\breturn\s+(?P=funcdec)\b/si
MiscreantPunch.EvilMacro.PSDL.M2.170906;Engine:81-255,Target:2;(0&1&(2|3)&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;496620{3-20}203e20302e{1-2}205468656e0d0a5368656c6c::i;2b2043687228::i;262043687228::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170908;Engine:81-255,Target:2;(6&7);4174747269627574652056425f::i;44696d::i;0&1/\s*(?P<var>[a-z]{3,15})\s+(?P=var)\s*=\s*#[0-9]{2}\/[0-9]{2}\/[0-9]{4}#/si;2270::i;2770::i;7020::i;2&(3|4|5)/[\x22\x27]p(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?w(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?h(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l/si;5368656c6c::i
MiscreantPunch.EvilMacro.PSDL.M2.170908;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;50726976617465204465636c61726520507472536166652053756220536c656570204c696220226b65726e656c333222::i;4372656174654f626a6563742822536372697074696e672e46696c6553797374656d4f626a6563742229::i;53747252657665727365::i;53706c6974::i;4f70656e5465787446696c65::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170911;Engine:81-255,Target:2;(0&1>300&2&3&4&5&6&7&8>20&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;43616c6c20::i;4f70656e20{3-25}20466f722042696e617279204163636573732057726974652041732023::i;5075742023::i;20436c6f73652023::i;456e7669726f6e24::i;43616c6c205642412e5368656c6c24::i;2e65786522::i;417272617928::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170911;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;417272617928::i;1/\s*(?:[0-9]{2,3}\s*,\s*){50,}[0-9]{2,3}\s*[\x22\x27]?\)/si;43687228::i;586f72::i;4a6f696e28::i;5374725265766572736528::i;4372656174654f626a65637428::i;575363726970742e5368656c6c::i;43616c6c42794e616d65::i;52756e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.SchTskAutoRun.170911;Engine:81-255,Target:2;(0&1&(2|3)&4&5&(6|7|8)&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;4372656174654f626a65637428::i;5368656c6c::i;2e52756e::i;7363687461736b732e657865::i;2f437265617465::i;2e766273::i;2e626174::i;2e657865::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170912;Engine:81-255,Target:2;(0&1&2&3&4);4174747269627574652056425f::i;59774274414751414941416d414341414c77424c41434141517742454143414151774136414341414a67416741464141627742334147554163674254414767415a5142734147774149414174414555416267426a414738415a41426c41475141517742764147304162514268414734415a4141674147::i;43616c6c205368656c6c::i;436872::i;2e52756e::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-8759-CommonConstruct;Engine:81-255,Target:2;0;C7B0ABEC197FD211978E0000F8757E2A00000000{4}7700730064006c003d00(6600740070|68007400740070)::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-8759-M2;Engine:81-255,Target:0;(0&1&2);0:7b5c7274;43374230414245433139374644323131393738453030303046383735374532413030303030303030;1/C7B0ABEC197FD211978E0000F8757E2A00000000.{8}[57]700[57]300[46]400[46]c003d00[46](?:800[57]4|6)00[57]400[57]000/si
MiscreantPunch.Evil.OfficeX.CVE-2017-8579;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1&2&3);3c52656c6174696f6e73686970::i;5461726765744d6f6465::i;45787465726e616c::i;0/<Relationship(?=[^>]+Target\s*=\s*[\x22\x27]?(?:soap\s*:\s*)?wsdl=\s*(?:https?|ftp))[^>]+TargetMode\s*=\s*[\x22\x27]?External/si
MiscreantPunch.EvilMacro.PSDL.170913;Engine:81-255,Target:2;(0&1>100&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;2026206368727728::i;4170706c69636174696f6e2e72756e::i;577363726970742e5368656c6c::i;4372656174654f626a656374::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170913;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;202620436872::i;203d205265706c61636528::i;43616c6c::i;4170706c69636174696f6e2e52756e::i;44696d::i;5/Dim\s*(?P<var>[a-z]{3,25})\s+(?:(?P=var)\s*=\s*[\x22\x27][^\x20]*[\x22\x27]\s+)?(?P=var)\s*=\s*[\x22\x27][^\r\n]+[\x22\x27]\s+(?:(?P=var)\s*=\s*(?P=var)\s*&\s*[\x22\x27][^\r\n]+[\x22\x27]\s+){3,}/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170913;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;46756e6374696f6e20{3-25}204c696220227368656c6c33322e646c6c2220416c69617320225368656c6c4578656375746541::i;43616c6c20::i;5c636d642e657865::i;5c53797374656d33325c::i;2f63206269747361646d696e::i;7374617274::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Ursnif.170913;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;5368656c6c::i;586f72::i;53706c697428::i;43616c6c20::i;203d204368722843427974652822264822::i;5265706c61636528::i;43687228::i;52756e203d205368656c6c28::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.CVE-2017-8759-CommonConstruct.M3;Engine:81-255,Target:2;0;73006F00610070003A007700730064006C003D00(6600740070|68007400740070)::i
MiscreantPunch.RTF.EvilRTF.CVE-2017-8759-M4;Engine:81-255,Target:0;(0&1&2);0:7b5c7274;326130303030303030303730303130303030::i;1/2a0000000070010000[57]700[57]300[46]400[46]c003d00[46](?:800[57]4|6)00[57]400[57]000/si
MiscreantPunch.RTF.EvilRTF.CVE-2010-3333.CommonConstruct;Engine:81-255,Target:0;(0);0:7b5c7274*7b5c*68707b*7b5c*7046*656e74737d7b5c737620313b31{1-2}66666666666666666666303530303030303030303030303030303030303030303030303030303030303030303030303030303030*41414141414141414141414141414141414141414141414141414141414141414141414141414141::i
MiscreantPunch.RTF.EvilRTF.CVE-2010-3333-Obfus;Engine:81-255,Target:0;(0&1=0);0:7b5c7274!(66)*5c736e207046*5c737620313b31;70467261676d656e7473
MiscreantPunch.RTF.CVE-2010-3333.Obfus-2;Engine:81-255,Target:0;(0);0:7b5c727431*313b3138*3b6666666666*414141414141414141414141414141414141
MiscreantPunch.EvilMacro.MultiPSDL.170914;Engine:81-255,Target:2;(0&1&2>10&3>5&4>20&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;203d20227022202b20::i;273b24::i;203d204172726179::i;4e756c6c::i;202b2043687228::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PSDL.170914;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;4f7074696f6e204578706c69636974::i;202b20436872::i;537472436f6e7628537472436f6e7628::i;2846696c654c656e28416374697665446f63756d656e742e46756c6c4e616d6529::i;586f72::i;4f70656e20416374697665446f63756d656e742e46756c6c4e616d6520466f722042696e61727920416363657373205265616420417320::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CVE-2017-8759-M5;Engine:81-255,Target:2;(0&1&2&3);4174747269627574652056425f::i;4765744f626a65637428::i;736f61703a7773646c::i;1/\s*[\x22\x27]?soap\s*:\s*wsdl=\s*(?:https?|ftp)/si
MiscreantPunch.EvilMacro.WMIDL.170915;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7>75&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;2349662056624137205468656e::i;23456c7365::i;23456e64204966::i;6c496220226b45724e656c33322220414c49417320224865617043726561746522::i;6c494220226b65726e454c33322220416c4961732022577269746550726f636573734d656d6f727922::i;43616c6c20::i;526544696d::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.XLSPhishLure.170918;Engine:81-255,Target:0;(0);455843454c2046696c6520497320536563757265642e2e20546f205669657720436f6d706c6574652046696c65::i
MiscreantPunch.EvilMacro.MacPhish.170818;Engine:81-255,Target:2;(0&1>2&2&3&4&5&6);4174747269627574652056425f::i;4d616353637269707428::i;7368656c6c20736372697074::i;6f7361736372697074::i;646973706c6179206469616c6f67::i;53706c6974::i;6375726c::i
MiscreantPunch.EvilMacro.MacPhishBeacon.170918;Engine:81-255,Target:2;(0&1);4174747269627574652056425f::i;4d6163536372697074202822646f207368656c6c20736372697074*6375726c::i
MiscreantPunch.EvilMacro.PSDL.170918;Engine:81-255,Target:2;(0&1>50&2>10&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;202b2043687228::i;203d20{2-20}202b2043687228{1-3}202b20{1-3}29202b2043687228{1-3}202b20{1-3}29202b2043687228{1-3}202b20::i;203d2043687228::i;203d204765744f626a65637428::i;2e47657428::i;2e537061776e496e7374616e6365::i;2e437265617465::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Emotet.170918;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;202a2048657828::i;586f72::i;202a2043687228::i;4368724228::i;4368725728::i;5642412e5368656c6c24::i;202b20416374697665446f63756d656e742e4275696c74496e446f63756d656e7450726f706572746965732822436f6d6d656e74732229::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.INCLPICInfoLeak.170919;Engine:81-255,Target:2;(0&1&2);13??494e434c55444550494354555245::i;4d45524745464f524d4154::i;0/\x13\s+INCLUDEPICTURE\s+[\x22\x27](?i)(?:f\x00(?:i\x00l\x00e|t\x00p)|h\x00t\x00t\x00p)(?-i).*?MERGEFORMAT\s+\x5cd\s+\x14\x01/s
MiscreantPunch.Exploit.CVE-2017-8759.EvilCSArtifact;Engine:81-255,Target:7;(0);7573696e672073797374656d3b*626173652e636f6e66696775726570726f787928746869732e67657474797065*626173652e636f6e66696775726570726f787928746869732e676574747970652829*626173652e636f6e66696775726570726f787928746869732e676574747970652829*73797374656d2e617070646f6d61696e2e63757272656e74646f6d61696e2e67657464617461285f75726c2e73706c6974*73797374656d2e646961676e6f73746963732e70726f636573732e7374617274285f75726c2e73706c6974
MiscreantPunch.EvilHTML.MaliciousLure.170919;Engine:81-255,Target:3;(0);746869732066696c652069732070726f74656374656420627920657863656c20646f63207365637572697479::i
MiscreantPunch.EvilMacro.Emotet.170920;Engine:81-255,Target:2;((0|1|2)&3&4);7a4144;4d774132;4d414e;560069007300750061006C00200042006100730069006300200046006F00720020004100700070006C00690063006100740069006F006E0073;(0|1|2)/(?:zAD|MwA2|MAN)[A-Za-z0-9+\x2f]{4,16}(?:MQAxAD|EAMQA5|xADEAO)[A-Za-z0-9+\x2f]{4,16}(?:MQAxAD|EAMQA1|xADEAN)[A-Za-z0-9+\x2f]{4,16}(?:OQA5|kAO|5AD)[A-Za-z0-9+\x2f]{4,16}(?:MQAxAD|EAMQA0|xADEAN)/
MiscreantPunch.EvilLNK.WMIDropper.170922;Engine:81-255,Target:0;(0&1&2);0:4c00000001140200;433a5c57696e646f77735c53797374656d33325c7762656d5c574d49432e657865;002500540045004d00500025005c0075006e006c006f0063006b002e0064006f0063002e006c006e006b
MiscreantPunch.EvilHTML.XMLPWRSHLL00;Engine:81-255,Target:3;(0&1&2&3&4&5);616374697665786f626a656374;777363726970742e7368656c6c;2e72756e;706f7765727368656c6c2e657865;2d657865637574696f6e706f6c69637920627970617373;2d656e636f646564636f6d6d616e64
MiscreantPunch.EvilMacro.VBDL.170926;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f::i;4c6f61644c696272617279204c696220226b65726e656c33322e646c6c2220416c69617320224c6f61644c6962726172795722::i;43616c6c::i;75726c6d6f6e::i;55524c446f776e6c6f6164546f46696c6557::i;7368656c6c3332::i;5368656c6c4578656375746557::i;456e7669726f6e242822415050444154412229::i;656e636f756e746572656420616e20756e6578706563746564206572726f72::i;66696c65206973206e6f7420636f6d70617469626c652077697468::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.VBSCrypter.170926;Engine:81-255,Target:7;(0);3d206172726179*64696d2063727970746564*666f7220696e646578203d203120746f20637279707465646c656e677468*7468656e2063727970746564203d206372797074656426*65786563757465286372797074656429
MiscreantPunch.EvilMacro.EvilDocAttribComments;Engine:81-255,Target:2;((0|1)&(2|3)&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));44696d::i;4174747269627574652056425f::i;5368656c6c::i;2e72756e::i;416374697665446f63756d656e74::i;4275696c74496e446f63756d656e7450726f70657274696573::i;436f6d6d656e7473::i;(2|3)/(?:shell|\.run)\b[^\r\n]*ActiveDocument\s*.\s*BuiltInDocumentProperties\s*\(\s*[\x22\x27]Comments[\x22\x27]/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170927;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;4170706c69636174696f6e2e52756e::i;0d0a;2/(?P<var>[A-Za-z]{5,30})\s*=\s*ActiveDocument\s*\.\s*Name\s+(?P<var2>[A-Za-z]{3,25})\s*=\s*Len\s*\(\s*(?P=var)\s*\)\s+If\s*(?P=var2)\s*[<>=]\s*[0-9]{1,3}\s*Then/si;4372656174654f626a65637428224d73786d6c322e444f4d446f63756d656e742e332e302229::i;437265617465456c656d656e7428226261736536342229::i;203d204372656174654f626a656374282241444f44422e53747265616d2229::i;2e4f70656e::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.170928;Engine:81-255,Target:2;(0&1&2&3&4);4174747269627574652056425f::i;577343724950742e7348456c6c::i;203d204372656174654f626a65637428::i;59774274414751414941416d414341414c77424c41434141517742454143414151774136414341414a67416741464141627742334147554163674254414767415a514273414777414941417441455541::i;2e52756e::i
MiscreantPunch.EvilMacro.MultiPSDL.170929;Engine:81-255,Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;4f7074696f6e204578706c69636974::i;4c696220226b45724e454c33322e444c4c2220416c696173202257696e4578656322::i;44696d::i;3/Dim\s+(?P<var>[a-z]{3,15})\s+(?P=var)\s*=\s*[\x22\x27[^\x22\x27]*[\x22\x27]\s+(?P=var)\s*=\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+(?P=var)\s*=\s*(?P=var)\s*&\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+(?:(?P=var)\s*=\s*(?P=var)\s*&\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s+){3,}/si;43687228::i;2e52756e::i
MiscreantPunch.Macro.PiratedOffice.171002;Engine:81-255,Target:2;(0&1);560069007300750061006C00200042006100730069006300200046006F00720020004100700070006C00690063006100740069006F006E0073;1E000000{4}5350656369616C6953542052655061636B::iwa
MiscreantPunch.Macro.PiratedOffice.171002.M2;Engine:81-255,Target:2;(0&1);560069007300750061006C00200042006100730069006300200046006F00720020004100700070006C00690063006100740069006F006E0073;1E000000{4}6469616B6F762E6E6574::iwa
MiscreantPunch.EvilMacro.SHBIN.170210;Engine:81-255,Target:2;(0&1&2);5368656c6c*4275696c74496e446f63756d656e7450726f70657274696573::i;4174747269627574652056425f::i;0/Shell\$?[\s\x28][^\r\n]*\.BuiltInDocumentProperties/i
MiscreantPunch.EvilMacro.CROCHRFUNC.171002;Engine:81-255,Target:2;(0&1&2&3);4372656174654f626a656374::i;46756e6374696f6e*436872*456e642046756e6374696f6e::i;0/CreateObject\s*\x28(?:[^\x29\r\n]+\x28|[^\r\n]*\s[&+]\s*\x5c?[\x22\x27][^\r\n]*?\x29)/i;1/Function\s*(?P<fname>[A-Za-z0-9_]+)\s*\([^\r\n]*(?P<var>[A-Za-z0-9_]+)\s+As\s+Int.*?\b(?P=fname)\b\s*=\s*Chr\$?\s*\(\s*\b(?P=var)\b.+?End\s+Function/si
MiscreantPunch.EvilMacro.MultiPSDL.171003;Engine:81-255,Target:2;(0&1&(2|3)&4&5&6&7);4174747269627574652056425f::i;4f7074696f6e204578706c69636974::i;4c696220226b45724e454c33322e444c4c2220416c696173202257696e4578656322::i;57696e45786563204c696220226b65726e656c333222::i;44696d::i;3/Dim\s+(?P<var>[a-z]{3,15})\s+(?:As\s+\w+\s+)?(?P=var)\s*=\s*[\x22\x27][^\r\n]*[\x22\x27]\s+(?:(?P=var)\s*=\s*[\x22\x27][^\r\n]+[\x22\x27]\s+)?(?P=var)\s*=\s*(?P=var)\s*[&+]\s*[\x22\x27][^\r\n]+[\x22\x27]\s+(?:(?P=var)\s*=\s*(?P=var)\s*[&+]\s*[\x22\x27][^\r\n]+[\x22\x27]\s+){3,}/si;43687228::i;2e52756e::i
MiscreantPunch.EvilMacro.PSEncode.171003;Target:2;(0&1=0&(2|3)&4);4174747269627574652056425f;706f7765727368656c6c::i;2270::i;2770::i;(2|3)/[\x22\x27]p[\s\x22\x27\x2b\x5e]*o[\s\x22\x27\x2b\x5e]*w[\s\x22\x27\x2b\x5e]*e[\s\x22\x27\x2b\x5e]*r[\s\x22\x27\x2b\x5e]*s[\s\x22\x27\x2b\x5e]*h[\s\x22\x27\x2b\x5e]*e[\s\x22\x27\x2b\x5e]*l/si
MiscreantPunch.EvilMacro.IVSRCCAT.171004;Engine:81-255,Target:2;(0&1&(2|3)&4&5&6);65(27|22)292e496e766f6b6528(27|22)68::i;7768696c652821243f293b::i;5368656c6c(20|24|28)::i;2e72756e::i;4174747269627574652056425f::i;7b327d::i;7b317d::i
MiscreantPunch.EvilMacro.MultiPSDL.171004;Engine:81-255,Target:2;(0&1>3&2&3&4&5&6>30&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;203d204172726179284e6f77::i;203d202270::i;496620::i;3/\s*[A-Za-z0-9_]{3,20}\s*[<>=]\s*[0-9]{1,3}\s*Then\s+Shell\s+[A-Za-z0-9_]+\s*,\s*[A-Za-z0-9_]{3,25}\s+End\s+If/si;5368656c6c::i;202b20::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CRDTCHREXEMATH.171005.M2;Engine:81-255,Target:2;(0&1&(2|3)&4&5>3&6);4372656174654f626a656374::i;3d20436872::i;5368656c6c::i;2e52756e::i;2e4461746154797065::i;4173204f626a656374::i;1/=\sChrW?\$?\s*?\x28\s*?(?:Asc\$?\x28(?:Mid\$?\x28[^\x29]+?\x29)?[^\x29]*?\x29)?[^\x29]*?\s(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor\b)[^\r\n]*?[&+][^\r\n]*?\bChrW?\$?\s*?\x28\s*?(?:Asc\$?\x28(?:Mid\$?\x28[^\x29]+?\x29)?[^\x29]*?\x29)?[^\x29]*?\s(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor\b)/si
MiscreantPunch.EvilMacro.MultiPSDL.171005;Engine:81-255,Target:2;(0&1&2&3>2&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;2e52756e::i;203d20??205468656e204578697420::i;3d204372656174654f626a65637428::i;575363726970742e5368656c6c::i;41444f44422e53747265616d::i;416374697665446f63756d656e742e50617261677261706873::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilCmd.F7Carb.171006;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9);0:40736574::i;406563686f::i;6e657720416374697665584f626a656374::i;536372697074696e672e46696c6553797374656d4f626a656374::i;577363726970742e5368656c6c::i;4f70656e5465787446696c65::i;537472696e672e66726f6d43686172436f6465::i;5c756e6c6f636b2e636d64::i;476574456e636f646564436f6e74656e7453747265616d::i;2e52756e::i
MiscreantPunch.EvilMacro.Hancichanitordal.171009;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8);4174747269627574652056425f::i;203d20537472436f6e7628{3-20}2c20{3-20}290d::i;203d205265706c61636528::i;202b204d696428::i;203d20537472526576657273652822{1-20}2229202b20537472526576657273652822{1-20}2229::i;2e65786522::i;43616c6c20::i;203d204372656174654f626a6563742822575363726970742e5368656c6c2229::i;496620496e53747252657628::i
#MiscreantPunch.EvilMacro.AOSPLICEDEXERUN.171009;Engine:81-255,Target:2;((0|1|2|3)&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24)&(25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44));(2b|26)20222e::i;(2b|26)20272e::i;26206368722428343629::i;262063687228343629::i;(0|1|2|3)/[+&]\s+(?:chr\$?\(46\)|[\x22\x27]\x2e)[\x2c\x27\x22+&\s]*(?:e|chr\$?\s*\(\s*69|101\s*\))[\x2c\x27\x22+&\s]*(?:x|chr\$?\s*\(\s*88|120\s*\))[\x2c\x27\x22+&\s]*(?:e|chr\$?\s*\(\s*69|101\s*\))\b/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.ThreeDollarsDL;Engine:81-255,Target:2;(0&1&2&3&(4|5)&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32));4174747269627574652056425f::i;203d20456e7669726f6e24::i;5368656c6c20456e7669726f6e24::i;706f7765727368656c6c::i;262043687228::i;202b20436872::i;4372656174654f626a656374::i;41444f44422e53747265616d::i;2e4f70656e::i;5265706c616365::i;2e4c6f616446726f6d46696c65::i;53706c6974::i;2e657865::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.171009;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;203d204372656174654f626a65637428::i;2e52756e::i;2030;0d0a;4/(?P<var>[A-Za-z]{3,20})\s*=\s*[^\s]+\s+(?P<var2>[A-Za-z]{3,20})\s*=\s*[\x22\x27][^\x22\x27]*[\x22\x27]\s+Set\s+(?P<var3>[A-Za-z]{3,20})\s*=\s*CreateObject\([^\r\n]+\s+[\x22\x27][^\x22\x27]*[\x22\x27]\s*[+&]\s*(?P=var2)\s*[+&]\s*[\x22\x27][^\x22\x27]*[\x22\x27]\s*[+&]\s*(?P=var)\s*\)\s+(?P=var3)\.Run\s*[^\s]+\,\s*0/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.PowerCatGen.171009;Engine:81-255,Target:2;(0&1>1&2>1&(3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22));4174747269627574652056425f::i;27706f7765726361742c20::i;2043616c6c205368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilDoc.DDEexec.DocX.171010;Engine:81-255,Target:0;(0&1);3c773a646f63756d656e74*696e737472*444445::i;0/\bDDE(?:AUTO)?(?:\s*\S+)?\s*[\x22\x27]?[a-z]\:\x5c+(?:[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+\x5c+)*[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\b/si
MiscreantPunch.EvilDoc.DDEexec.171010;Engine:81-255,Target:2;(0&1&2);00000000000000000000000000000000*444445;0/\bDDE(?:AUTO)?(?:\s*\S+)?\s*[\x22\x27]?[a-z]\:\x5c+(?:[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+\x5c+)*[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\b/si;4d6963726f736f6674204f6666696365::i
#MiscreantPunch.EvilDocX.DDEFFORMULA.171110;Engine:81-255,Target:7;(0&1);773a666c646368617274797065*646465::i;0/w\:fldCharType\s*=\s*[\x22\x27]begin[\x22\x27](?:(?!w\:fldCharType\s*=\s*[\x22\x27]end).)+?[\x22\x27>]\s*DDE(?:AUTO)?\b/si
MiscreantPunch.EvilHTML.VBSDL.171010;Engine:81-255,Target:3;(0&1&2&3&4>20&5&6);0:3c68746d6c3e::i;3c534352495054::i;5642536372697074::i;536574{3-25}3d4372656174654f626a65637428225368656c6c2e4170706c69636174696f6e2229{3-25}2e5368656c6c457865637574654368725728::i;264368725728::i;2e657865::i;73746172742d70726f63657373::i
MiscreantPunch.EvilMacro.SEGenDL.171011;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4c696220227368656c6c33322e646c6c2220416c69617320225368656c6c457865637574654122::i;5368656c6c4578656375746528::i;44696d::i;3/Dim\s+(?P<var>[A_Za-z0-9]{2,25})\s+As\s+String\s+(?P=var)\s*=\s*[\x22\x27](?:(?:f|ht)tps?)?[^\x22\x27]+[\x22\x27]\s+[^\r\n]+\s*=\s*ShellExecute\s*\(/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.GenVBDL.171011;Engine:81-255,Target:2;(0&1>2&2&3&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;204d696428::i;496e537472::i;203d204372656174654f626a65637428225368656c6c2e4170706c69636174696f6e2229::i;3d204372656174654f626a65637428226d6963726f736f66742e786d6c687474702229::i;203d20456e7669726f6e2822746d702229::i;2e4f70656e202247455422::i;203d204372656174654f626a656374282261646f64622e73747265616d2229::i;2e53617665546f46696c65::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.171011;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;417320537472696e67203d2022266822::i;537472436f6e7628::i;203d2043687228::i;203d205368656c6c28::i;20586f7220::i;44696d::i;6/Dim\s*(?P<var>[A-Za-z0-9]{2,35})\s+As\s+String\s+(?P=var)\s*=\s*(?:[^,]+,\s*[^\x22\x27]+)?[\x22\x27]\s*[a-f0-9]{100,}[\x22\x27]/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Emotet.171014;Engine:81-255,Target:2;(0&1>25&2>25&3>25&4>50&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;4d696428::i;526967687428::i;4c65667428::i;202b20::i;5368656c6c::i;202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b2022636f4d6d656e747322202b20{5-10}202b20{5-10}202b20::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.CVE-2017-0199.CommonConstruct.M13;Engine:81-255,Target:2;(0&1);E0C9EA79F9BACE118C8200AA004BA90B*002E006800740061000000::i;0/\xE0\xC9\xEA\x79\xF9\xBA\xCE\x11\x8C\x82\x00\xAA\x00\x4B\xA9\x0B.{10,14}\x3a(?:(?!\x00\x00).)+?\x00\.\x00h\x00t\x00a\x00\x00\x00/si
#MiscreantPunch.EvilDoc.DDEexecWide.171010;Engine:81-255,Target:2;(0&1);00000000000000000000000000000000*00440044004500*3a00*5c00*002e006500780065::i;0/\x00D\x00D\x00E\x00(?:A\x00U\x00T\x00O\x00)?(?:\s\x00)*(?:[\x22\x27]\x00)?[a-z]\x00\x3a\x00(?:\x5c\x00)+(?:[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+(?:\x5c\x00)+)*[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+\x00\.\x00e\x00x\x00e\x00/si
MiscreantPunch.EvilDocX.DDEFFORMULA.171610;Engine:81-255,Target:7;(0&1&2);773a666c646368617274797065::i;3c773a646f63756d656e74::i;0/w\:fldCharType\s*=\s*[\x22\x27]begin[\x22\x27](?:(?!w\:fldCharType\s*=\s*[\x22\x27]end).)+?\bD(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?D(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?E(?:(?!w\:fldCharType\s*=\s*[\x22\x27]end).)+?(?:(?!w\:fldCharType\s*=\s*[\x22\x27]end).)+?[a-z](?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?\x3a(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?[\x2f\x5c](?:(?!w\:fldCharType\s*=\s*[\x22\x27]end).)+?\x2e(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?E(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?X(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?E/si
MiscreantPunch.XLSB.NETDDE.NamedEXE.171610;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1);0:e802*0100??000000*c104*4100*ca0407*0000000001cb0400c104220f00000053007400640044006f00630075006d0065006e0074004e0061006d006500ca0407*0000000001cb0400*cc0400;0/^\xe8\x02.{1,10}\x01\x00(?:\x03\x00\x00\x00(?:c\x00m\x00d|n\x00e\x00t|r\x00e\x00g)|\x04\x00\x00\x00w\x00m\x00i\x00c|\x05\x00\x00\x00(?:m\x00s\x00h\x00t\x00a|n\x00e\x00t\x00s\x00h)|\x07\x00\x00\x00[cjw]\x00s\x00c\x00r\x00i\x00p\x00t|\x08\x00\x00\x00(?:c\x00e\x00r\x00t\x00u\x00t\x00i\x00l|r\x00e\x00g\x00s\x00v\x00r\x003\x002|c\x00h\x00t\x00a\x00s\x00k\x00s|v\x00s\x00s\x00a\x00d\x00m\x00i\x00n))\x00.+\xca\x04\x07.+\xcc\x04\x00$/si
MiscreantPunch.EvilMacro.Retefe.171017;Engine:81-255,Target:2;(0&1>300&2>300&(3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22));4174747269627574652056425f::i;4966204c656e28{3-10}29203e20{1-3}205468656e::i;4d7367426f782022{3-10}222c20{1-3}2c2022{3-10}220d::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Emotet.171018;Engine:81-255,Target:2;(0&1>25&2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;4d696428::i;5368656c6c::i;202b2043687228::i;202b20{5-15}202b20{5-15}202b20{5-15}202b20{5-15}202b20{5-15}202b20{5-15}202b20{5-15}202b20{5-15}202b20;4c67416f414341414a41424641473441646741364146414164514269414577415351426a414673414d;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Retefe.171018;Engine:81-255,Target:2;(0&1>300&2>300&3>1&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4966204c656e28{3-15}29203c20{1-3}205468656e::i;4d7367426f782022{3-15}222c20{1-3}2c2022{3-15}220d::i;2043687228::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Emotet.171020;Engine:81-255,Target:2;(0&1&2>25&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4a674167414367414941416b414555416267423241446f4155414231414749415441424a41474d41577741784144::i;4d696428::i;5368656c6c::i;2043687228::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Emotet.171023;Engine:81-255,Target:2;(0&1&2&3&4>50&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;5368656c6c::i;202b20::i;2/[\x22\x27]c(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?m(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?d(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?/si;203d204d696428::i;202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20{5-10}202b20;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilDoc.B64EncodedPayload.171023;Engine:81-255,Target:2;((0|1|2|3|4|5)&(6|7)&8&9);54567151;54566f41;54567042;54567051;54567141;5456726f;4d6963726f736f667420576f7264::i;4d53576f7264446f63::i;4e65774d6163726f73::i;5c564245(36|37)2e444c4c::i
#MiscreantPunch.EvilMacro.XORREGWRRUN;Engine:81-255,Target:2;(0&1&2&3&4&5&(6|7)&(8|9));2e657865::i;7265677772697465::i;536f667477617265::i;4d6963726f736f6674::i;43757272656e7456657273696f6e::i;52756e::i;20786f72::i;205e20::i;4174747269627574652056425f::i;44696d20::i
MiscreantPunch.EvilMacro.SHELLMULTISTRCONAO.172310;Engine:81-255,Target:2;(0&1&(2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21));5368656c6c::i;0/Shell\$?\s*\(?\s*(?:\x22\x22|\x27\x27)\s+[&+]\s+(?:[^\r\n]*?\s[+&]\s){15}/i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.TrickBot.171023.M1;Engine:81-255,Target:2;(0&1&2&3);4174747269627574652056425f;2e52756e206d79666f726d312e54657874426f78322c20302c2054727565;53756220;2/Sub\s+[A-Za-z0-9]{3,20}\s*\((?P<var>[A-Za-z0-9]{3,25})\)\s+(?P=var)\.Run\s*myform1\.TextBox2\,\s0\,\sTrue\s+End\sSub/si
MiscreantPunch.EvilMacro.TrickBot.171023.M2;Engine:81-255,Target:2;(0&1&2&3);4174747269627574652056425f;203d20300d0a;466f7220{1-20}203d203120546f2039300d0a;203d2049496628{3-20}202d20{3-20}203c3d20302c203930202b20{3-20}202d20{3-20}2c20{3-20}202d20{3-20}290d0a
MiscreantPunch.EvilRTF.DDEFFORMULA.171610;Engine:81-255,Target:0;(0&1);0:7b5c7274*444445::i;0/\bDDE(?:AUTO)?(?:\s*\S+)?\s*[\x22\x27]?[a-z]\:\x5c+(?:[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+\x5c+)*[^\x5c\x2f\x3a\x22\x2a\x3f\x3c\x3e\x7c\x0d\x0a]+\.(?:c(?:[ho]m|md|pl)|m(?:s[cipt]|d[be])|p(?:yw?|cd|if|s1)|s(?:c[rt]|h[bs])|v(?:b(?:e|s(?:cript)?)?|xd)|a(?:d[de]|sp)|i(?:n[fs]|s[pu]|nx)|r(?:eg|gs|b)|j(?:se?|ar|ob)|3(?:86|gr)|d(?:iagcab|bx|ll)|h(?:lp|ta)|ws[cfh]?|ba[st]|gadget|exe|fon|lnk|ocx|u3p)\b/si
MiscreantPunch.EvilMacro.Retefe.171023;Engine:81-255,Target:2;(0&1>100&2>100&3>2&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4966204c656e28{3-15}29203c??20{1-3}205468656e::i;4d7367426f782022{3-15}222c20{1-3}2c2022{3-15}220d::i;2043687228::i;43616c6c20;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.Emotet.172610;Engine:81-255,Target:2;((0|1)&(2|3)&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51|52|53|54)>10);4174747269627574652056425f;44696d20;5368656c6c::i;2e72756e::i;413041445541;413241444541;413241446341;413541446741;413541446b41;414445414d41413141;414445414d41413241;414445414d41417841;414445414d51413041;414445414d51413141;414445414d51413241;414445414d51413541;414445414d51417741;414445414d51417841;414445414d51417941;41444d414d67;41444d414e67;414451414e51;414459414d51;414459414e77;41446b414f41;41446b414f51;414d51417741444541;414d51417741445541;414d51417741445941;414d51417841444141;414d51417841444541;414d51417841444941;414d51417841445141;414d51417841445541;414d51417841445941;414d51417841446b41;414d77413241;414d77417941;414e41413141;414e67413341;414e67417841;414f51413441;414f51413541;4178414441414d51;4178414441414e51;4178414441414e67;4178414445414d41;4178414445414d51;4178414445414d67;4178414445414e41;4178414445414e51;4178414445414e67;4178414445414f51;417a41444941;417a41445941
#MiscreantPunch.EvilMacro.SHELLMULTISTRCONAO.172310.M2;Engine:81-255,Target:2;(0&1&(2|3));5368656c6c::i;0/Shell[^\w\r\n](?:[^\r\n]*?\s[+&]\s){15}/i;4174747269627574652056425f;44696d20
#MiscreantPunch.EvilMacro.SHELLMULTISTRCONAO.172310.M2;Engine:81-255,Target:2;(0&1);4174747269627574652056425f*5368656c6c::fi;0/\bShell\b[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s[^\r\n]*?\s[+&]\s/i
MiscreantPunch.EvilMacro.MultiPSDL.171030;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;203d20417272617928::i;7662556e69636f6465::i;203d203020546f204c656e28::i;5368656c6c::i;43616c6c204170706c69636174696f6e2e52756e28::i;5/Call Application\.Run\(\s*[\x22\x27][^\(]+\(\s*[\x22\x27]\s*[0-9]{100,}\s*[\x22\x27]\s*\)/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDocX.DDEFFORMULADECPATH.173010;Engine:81-255,Target:7;(0&1&2&3);3436;773a666c646368617274797065::i;0/46\b\s*?(?:\b(45|101)\b)\s*?(?:\b(58|120)\b)\s*?(?:\b(45|101)\b)/s;1/w\:fldCharType\s*=\s*[\x22\x27]begin[\x22\x27](?:(?!w\:fldCharType\s*=\s*[\x22\x27]end).)+?\bD(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?D(?:\s*<\/?w\:(?!fldChar[^>]*?fldCharType\s*=\s*[\x22\x27]end)[^>]+>\s*)*?E\b/si
MiscreantPunch.EvilMacro.Smokeloader.171030;Engine:81-255,Target:2;(0&1&2>2&3&4&5&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;5642412e5368656c6c24::i;202b2043687228::i;2e65786522::i;636d642e657865::i;4/cmd\.exe\s*(?:\/c\s*)?b(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?i(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?t(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?a(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?d(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?m(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?i(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?n(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilJS.PandaDL.171031;Engine:81-255,Target:7;(0&1&2&3&4);766172::i;0/var\s*(?P<var1>[A-Za-z]{8,20})\s*=\s*[\x22\x27]\s*(?P<var2>[A-Za-z]{8}).+var\s*[^\x20]+\s*=\s*(?P=var1)\s*\.replace\s*\(RegExp\s*\(\s*[\x22\x27](?P=var2)\s*[\x22\x27]/si;73657454696d656f7574::i;2e7265706c61636528526567457870::i;6576616c::i
MiscreantPunch.EvilMacro.MultiPSDL.1.171031;Engine:81-255,Target:2;(0&1>20&2&3>20);4174747269627574652056425f;4d7367426f782022{3-15}222c20{1-3}2c2022{3-15}220d;43616c6c205642412e5368656c6c;496620{3-15}203c3e20{1-3}205468656e0d
MiscreantPunch.EvilMacro.MultiPSDL.2.171031;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;2349662056424137205468656e::i;4c696220224b65726e656c33322220416c696173202243726561746550726f636573734122::i;4368725728::i;262043687228::i;2b2043687228::i;44696d::i;6/Dim\s*[^\x20]+\s*=\s*[\x22\x27][a-z0-9]{100,}\s*[\x22\x27]/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.CVE-2017-8759.Soap.Exploit;Engine:81-255,Target:0;(0&1);3c73657276696365*3c706f7274*6c6f636174696f6e*70726f636573732e7374617274::i;0/<service(?:(?!<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27](?:(?!<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start/si
MiscreantPunch.EvilXML.APT28Drop.171102;Engine:81-255,FileSize:0-10000,Target:0;(0&1&2&3&4&5&6&7&8&9);0:3c3f786d6c20::i;72756e646c6c33322e657865::i;6a617661736372697074::i;52756e48544d4c4170706c69636174696f6e::i;416374697665584f626a656374::i;575363726970742e5368656c6c::i;2e52756e::i;706f7765727368656c6c2e657865::i;494558::i;2e646f776e6c6f6164737472696e67::i
MiscreantPunch.EvilMacro.PSDL.Squiblydoo.171103;Engine:81-255,Target:2;(0&1&2&3);4174747269627574652056425f::i;636d64{1-15}2f63{1-25}7265677376723332{1-25}68747470{1-50}2e736374207363726f626a2e646c6c::i;5368656c6c::i;766248696465::i
MiscreantPunch.EvilMacro.Squiblydoo;Engine:81-255,Target:2;(0&(1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20));417474726962757465205642*7363726f626a2e646c6c::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.MultiPSDL.171106;Engine:81-255,Target:2;(0&1&2&3&4);4174747269627574652056425f::i;203d20417272617928::i;203d2063687228::i;20262063687228::i;1/\s*=\s*Array\s*\(\s*(?:[0-9]{2,3}\s*\,\s*){5,}[0-9]{2,3}\s*\)\x0d\x0a[^=]+\s*=\s*chr\s*\([^\)]+\s*\)\)\s*&\s*(?:chr\s*\([^\)]+\s*\)\)\s*&\s*){5,}chr\s*\([^\)]+\s*\)\)\x0d\x0a/si
MiscreantPunch.EvilMacro.B64DPATHEXEPRIME.172610;Engine:81-255,Target:2;(0&(1|2|3|4|5|6|7|8|9|10|11|12|13)&(14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32|33)&(34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51|52));4174747269627574652056425f;4174747269627574652056425f*30325745;4174747269627574652056425f*455432783459;4174747269627574652056425f*463663474e59;4174747269627574652056425f*4e4e6c6847;4174747269627574652056425f*524539736547;4174747269627574652056425f*52506248686a;4174747269627574652056425f*52656e426a57;4174747269627574652056425f*54545a5952;4174747269627574652056425f*555870775931;4174747269627574652056425f*444f6c7863;4174747269627574652056425f*4d365846;4174747269627574652056425f*517a706358;4174747269627574652056425f*496e6b50696374757265315f5061696e746564::i;4174747269627574652056425f*4175746f45786563::i;4174747269627574652056425f*4175746f4f70656e::i;4174747269627574652056425f*4175746f5f4f70656e::i;4174747269627574652056425f*4175746f436c6f7365::i;4174747269627574652056425f*4175746f5f436c6f7365::i;4174747269627574652056425f*4175746f45786974::i;4174747269627574652056425f*4175746f4e6577::i;4174747269627574652056425f*446f63756d656e744f70656e::i;4174747269627574652056425f*446f63756d656e745f4f70656e::i;4174747269627574652056425f*446f63756d656e74436c6f7365::i;4174747269627574652056425f*446f63756d656e745f436c6f7365::i;4174747269627574652056425f*446f63756d656e744265666f7265436c6f7365::i;4174747269627574652056425f*446f63756d656e744368616e6765::i;4174747269627574652056425f*446f63756d656e745f4e6577::i;4174747269627574652056425f*4e6577446f63756d656e74::i;4174747269627574652056425f*576f726b626f6f6b5f4f70656e::i;4174747269627574652056425f*576f726b626f6f6b4f70656e::i;4174747269627574652056425f*576f726b626f6f6b5f4163746976617465::i;4174747269627574652056425f*576f726b626f6f6b5f436c6f7365::i;4174747269627574652056425f*2e72756e::i;4174747269627574652056425f*7368656c6c::i;4174747269627574652056425f*5348437265617465546872656164::i;4174747269627574652056425f*52746c4d6f76654d656d6f7279::i;4174747269627574652056425f*577269746550726f636573734d656d6f7279::i;4174747269627574652056425f*57726974655669727475616c4d656d6f7279::i;4174747269627574652056425f*43616c6c57696e646f7750726f63::i;4174747269627574652056425f*456e756d5265736f757263655479706573::i;4174747269627574652056425f*456e756d53797374656d4c616e677561676547726f757073::i;4174747269627574652056425f*456e756d55494c616e677561676573::i;4174747269627574652056425f*456e756d44617465466f726d617473::i;4174747269627574652056425f*456e756d43616c656e646172496e666f::i;4174747269627574652056425f*456e756d54696d65466f726d617473::i;4174747269627574652056425f*5348437265617465546872656164::i;4174747269627574652056425f*47726179537472696e67::i;4174747269627574652056425f*43726561746554696d6572517565756554696d6572::i;4174747269627574652056425f*43726561746550726f63657373::i;4174747269627574652056425f*57696e33325f50726f63657373::i;4174747269627574652056425f*4d6163536372697074::i;4174747269627574652056425f*57696e45786563::i
MiscreantPunch.EvilMacro.MultiPSDL.171106;Engine:81-255,Target:2;(0&1&2&3>1&4&5&6&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f::i;4f7074696f6e204578706c69636974::i;2349662056424137205468656e::i;204c696220224b65726e656c33322220416c696173202243726561746550726f636573734122::i;203d20436872572843427974652843687228::i;262043687228::i;2026204d696424::i;20586f7220::i;2b2043687228::i;4d6f64204c656e28::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Retfe.171107;Engine:81-255,Target:2;(0&1>10&2>10&(3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22));4174747269627574652056425f::i;496620{2-3}203c3e20{2-3}205468656e::i;43616c6c204d7367426f782822{3-15}222c20{2-3}2c2022{3-15}2229::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.171108;Engine:81-255,Target:2;(0&1&2>10);4174747269627574652056425f::i;5368656c6c2420{5-25}2c2030::i;203d20284d6964282822{15-250}22292c20{2-3}2c20{2-3}2929::i
MiscreantPunch.EvilMacro.INVOKEXPB64.1;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;415351424f41;2/ASQBOA[FH]YA[Tb]wB[Lr]A[EG]UALQB[Fl]A[FH]gA/
MiscreantPunch.EvilMacro.INVOKEXPB64.2;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;415351427541;2/ASQBuA[FH]YA[Tb]wB[Lr]A[EG]UALQB[Fl]A[FH]gA/
MiscreantPunch.EvilMacro.INVOKEXPB64.3;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;416151427541;2/AaQBuA[FH]YA[Tb]wB[Lr]A[EG]UALQB[Fl]A[FH]gA/
MiscreantPunch.EvilMacro.INVOKEXPB64.4;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;416151424f41;2/AaQBOA[FH]YA[Tb]wB[Lr]A[EG]UALQB[Fl]A[FH]gA/
MiscreantPunch.EvilMacro.INVOKEXPB64.5;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;427041453441;2/BpAE4A[Vd]gB[Pv]A[EG]sA[RZ]QAtA[EG]UA[We]A/
MiscreantPunch.EvilMacro.INVOKEXPB64.6;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;424a41473441;2/BJAG4A[Vd]gB[Pv]A[EG]sA[RZ]QAtA[EG]UA[We]A/
MiscreantPunch.EvilMacro.INVOKEXPB64.7;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;41456b416267;2/AEkAbgB[2W]A[EG]8A[Sa]wB[Fl]AC0A[RZ]QB[4Y]A/
MiscreantPunch.EvilMacro.INVOKEXPB64.8;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;424a41453441;2/BJAE4A[Vd]gB[Pv]A[EG]sA[RZ]QAtA[EG]UA[We]A/
MiscreantPunch.EvilMacro.INVOKEXPB64.9;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;41476b415467;2/AGkATgB[2W]A[EG]8A[Sa]wB[Fl]AC0A[RZ]QB[4Y]A/
MiscreantPunch.EvilMacro.INVOKEXPB64.10;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;41476b416267;2/AGkAbgB[2W]A[EG]8A[Sa]wB[Fl]AC0A[RZ]QB[4Y]A/
MiscreantPunch.EvilMacro.INVOKEXPB64.11;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;427041473441;2/BpAG4A[Vd]gB[Pv]A[EG]sA[RZ]QAtA[EG]UA[We]A/
MiscreantPunch.EvilMacro.INVOKEXPB64.12;Engine:81-255,Target:2;((0|1)&2&3);417474726962757465205642::i;44696d20::i;41456b415467;2/AEkATgB[2W]A[EG]8A[Sa]wB[Fl]AC0A[RZ]QB[4Y]A/
MiscreantPunch.EvilMacro.MultiPSDL.171108.M2;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;28290d0a::i;1/\(\)\x0d\x0a(?P<var>[a-z]{3,10})\.[a-z]{3,15}\s+(?P=var)\.[a-z]{3,15}\s+(?P=var)\.[a-z]{3,15}\s+(?P=var)\.[a-z]{3,15}\s+(?P=var)\.[a-z]{3,15}\s+(?P=var)\.[a-z]{3,15}\s+/si;5642412e5368656c6c24::i;3/VBA\.Shell\$\s*[^&]+\s*&\s*(?:[^&]+\s*&\s*){5,}[^&]+\,\s*0\s+End\s*Sub/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
#MiscreantPunch.EvilMacro.Emotet.171011;Engine:81-255,Target:2;(0&(1>10)&(2|3));5368656c6c::i;4d6964{22-500}(30|31|32|33|34|35|36|37|38|39)29202b20::i;44696d20::i;4174747269627574652056425f::i
#MiscreantPunch.EvilMacro.FUNCHSELLOBFUS.171511;Engine:81-255,Target:2;(0&1&2&(3|4)&5);66756e6374696f6e*7368656c6c::i;656e7669726f6e::i;666f72::i;636872::i;786f72::i;0/Function\s+[^\r\n\s]+\s*\(\s*(?P<var>[A-Za-z][A-Za-z0-9\x2e_-]*)\s+As(?:(?!End\s+Function).)+?Shell[^\w\r\n]{0,3}\s*(?P=var)\s*,\s*(?!(?:\s*[123456](?!(?:\s*[\x2a\x2d\x2b\x2f\x5e\x25]|\s*xor\b))|\s*vb(?:M(?:inimized(?:No)?|aximized)|Normal(?:No)?)Focus|True))./si
MiscreatnPunch.EvilMacro.XOREXECOBFUS.171511;Engine:81-255,Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23)&(24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43));436872{0-3}284342797465{0-1}28436872::i;20786f7220::i;206d6964::i;1/Function\s+(?P<func>[A-Za-z][A-Za-z0-9\x2e_-]+)\s*\(\s*(?:ByVal)?\s*(?P<var1>[A-Za-z][A-Za-z0-9\x2e_-]+)\s+As\s+[A-Za-z0-9\x2e_-]+\s*,\s*(?:ByVal)?\s*(?P<var2>[A-Za-z][A-Za-z0-9\x2e_-]*)\s+As\s(?:(?!End\s+Function).)*?\s(?P=func)\s*=\s*(?:(?P=var1)|(?P=var2))\s+Xor\s+(?:(?P=var1)|(?P=var2))/si;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
#MiscreantPunch.EvilRTF.DDEFFORMULA.171610;Engine:81-255,Target:0;(0&1&2);0:7b5c7274;444445*433a(5c|2f)*2e657865::i;1/\bDDE(?:AUTO)?\b/i
MiscreantPunch.EvilRTF.DDE.Lure.171610;Engine:81-255,Target:0;(0&1&2&3&4);0:7b5c7274;21556e657870656374656420456e64206f6620466f726d756c61::i;5c4d53576f72642e657865::i;506f7765727368656c6c::i;5c2e2e5c::i
MiscreantPunch.EvilMacro.ASCIIHEXTRINGEXE.171610;Engine:81-255,Target:2;((0|1|2)&(3|4)&5);4174747269627574652056425f::i;44696d20::i;5c564245(36|37)2e646c6c::i;3444{0-10}3541{0-10}3930{0-10}3030::awi;3534{0-10}3638{0-10}3639{0-10}3733{0-10}3230{0-10}3730{0-10}3732{0-10}3666{0-10}3637{0-10}3732{0-10}3631{0-10}3664::iaw;3,4/4D(?P<var>[^\r\n]{0,10})5A(?P=var)90(?P=var)00/si
MiscreantPunch.RTF.2017-0199.Obfus.171711;Engine:81-255,Target:0;(0&1&2&(3|4|5|6));0:7b5c727466;0/^\{\x5crtf(?!1?\x5c)/;5c6f626a757064617465;5c6f626a656d62;5c6f626a6175746c696e6b;5c6f626a6c696e6b;e0c9ea79f9bace118c8200aa004ba90b*00740070::i
MiscreantPunch.EvilDoc.CommonHeapSprayTechinque.171711;Engine:81-255,Target:7;(0&1&2&3&4);3c3f786d6c::i;61783a6f6378::i;61783a6f6378::i;61783a636c61737369643d227b30303030303030302d303030302d303030302d303030302d3030303030303030303030317d22::i;786d6c6e733a61783d22687474703a2f2f736368656d61732e6d6963726f736f66742e636f6d2f6f66666963652f323030362f6163746976655822::i
MiscreantPunch.EvilMacro.MULTIMIDMULTIARREXE.171711;Engine:81-255,Target:2;((0>30)&(1>30)&(2>30)&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24)&(25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44));3d2022::i;4d6964::if;4172726179::fi;0/=\s*\x22[a-zA-Z0-9\x2f+=]{100}/;1/Mid\s*\(\s*[A-Za-z]/;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.SHEXECENVEXEDL.171711;Engine:81-255,Target:2;((0|1)&2&3&4&5);44696d20::i;4174747269627574652056425f::i;436f707955524c546f46696c65::i;5368656c6c45786563757465::i;456e7669726f6e::i;2e657865::i
#MiscreantPunch.EvilMacro.PSHELLENVAUOEXEC.171911;Engine:81-255,Target:2;((0|1)&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23)&(24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43));4174747269627574652056425f::i;44696d20::i;456e7669726f6e::if;706f7765727368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;2e72756e::i;7368656c6c::fi;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.PSHELLSPROCB64.1;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;415577425541;4/AUwBUA[EG]EA[Uc]gB[0U]AC0A[Uc]AB[Sy]A[EG]8A[QY]wB[Fl]A[FH]MA/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.2;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;425441485141;4/BTAHQA[QY]QB[Sy]A[FH]QALQB[Qw]A[FH]IA[Tb]wB[Dj]A[EG]UA[Uc]w/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.3;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;41484d416441;4/AHMAdAB[Bh]A[FH]IA[Vd]AAtA[FH]AA[Uc]gB[Pv]A[EG]MA[RZ]QB[Tz]A/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.4;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;416377425541;4/AcwBUA[EG]EA[Uc]gB[0U]AC0A[Uc]AB[Sy]A[EG]8A[QY]wB[Fl]A[FH]MA/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.5;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;416377423041;4/AcwB0A[EG]EA[Uc]gB[0U]AC0A[Uc]AB[Sy]A[EG]8A[QY]wB[Fl]A[FH]MA/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.6;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;427a41465141;4/BzAFQA[QY]QB[Sy]A[FH]QALQB[Qw]A[FH]IA[Tb]wB[Dj]A[EG]UA[Uc]w/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.7;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;41484d415641;4/AHMAVAB[Bh]A[FH]IA[Vd]AAtA[FH]AA[Uc]gB[Pv]A[EG]MA[RZ]QB[Tz]A/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.8;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;41464d415641;4/AFMAVAB[Bh]A[FH]IA[Vd]AAtA[FH]AA[Uc]gB[Pv]A[EG]MA[RZ]QB[Tz]A/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.9;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;425441465141;4/BTAFQA[QY]QB[Sy]A[FH]QALQB[Qw]A[FH]IA[Tb]wB[Dj]A[EG]UA[Uc]w/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.10;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;415577423041;4/AUwB0A[EG]EA[Uc]gB[0U]AC0A[Uc]AB[Sy]A[EG]8A[QY]wB[Fl]A[FH]MA/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.11;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;41464d416441;4/AFMAdAB[Bh]A[FH]IA[Vd]AAtA[FH]AA[Uc]gB[Pv]A[EG]MA[RZ]QB[Tz]A/
MiscreantPunch.EvilMacro.PSHELLSPROCB64.12;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;427a41485141;4/BzAHQA[QY]QB[Sy]A[FH]QALQB[Qw]A[FH]IA[Tb]wB[Dj]A[EG]UA[Uc]w/
MiscreantPunch.EvilRTF.Exploit.2017-11882;Engine:81-255,Target:0;(0&1&2&(3|4));0:7b5c7274;5c6f626a757064617465::i;5c6f626a656d62::i;4571756174696f6e2e33::i;3030303243453032303030303030303043303030303030303030303030303436::i
MiscreantPunch.EvilDoc.Exploit.2017-11882;Engine:81-255,Target:2;(0&1&2);4571756174696F6E204E6174697665::aw;02CE020000000000C000000000000046;1/\x02\xCE\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46.+?\x03[\x00\x01][\x00\x01]\x03.{0,500}\x08[\x01\x02]\x81[^\x00]{36}/si
MiscreantPunch.EvilMacro.EncXorChrDrop;Engine:81-255,Target:2;(0&1&2&3&4&5&6>50&7>50&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;2e4f70656e2028::i;203d20{5-25}20262043687228{2-3}20586f7220{1-3}290d::i;4372656174654f626a6563742843687228{2-3}20586f7220{1-3}2920262043687228{2-3}20586f7220{1-3}2920262043687228{2-3}20586f7220{1-3}2920262043687228::i;2e5772697465::i;2e436c6f7365::i;586f72::i;436872::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Exploit.2017-11882.M2;Engine:81-255,Target:2;(0&1);4571756174696F6E2E33::aw;0/\x45\x71\x75\x61\x74\x69\x6F\x6E\x2E\x33.+?\x08.{2}(?:[^\x00]{0,36}(?:\.exe\b|\x5c\x5c(?=[^\x5c\x00]{1,36}\x5c)[A-Za-z0-9_\-\s]{1,36}\x5c|cmd\s*\x2f)|[^\x00]{36,}\x12\x0C\x43\x00)/si
MiscreantPunch.EvilMacro.UrsnifDL.171120;Engine:81-255,Target:2;(0&1>75&2>150&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;203d20417272617928::i;20537472696e6728::i;5368656c6c20::i;4d7367426f78202244656372797074696f6e206572726f7222::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.171120;Engine:81-255,Target:2;(0&1);4174747269627574652056425f::i;53657420{3-25}203d204372656174654f626a6563742822577363726970742e5368656c6c22290d0a{3-25}2e52756e20{3-25}2c20300d0a456e642046756e6374696f6e::i
#MiscreantPunch.EvilMacro.GenPSDL.171121;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&(8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27));4174747269627574652056425f::i;4372656174654f626a65637428::i;1/\s*[\x22\x27]a(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?d(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?d(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?b(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?\.(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?t(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?a(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(?:\^(?:[\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?m/si;226522::i;227822::i;222e22::i;2e726573706f6e7365626f6479::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.BartellaxDL.171121;Engine:81-255,Target:2;(0&1&2&3&4&5&6);4174747269627574652056425f::i;203d20416374697665446f63756d656e742e436861726163746572732e436f756e74202d2031::i;49662028416374697665446f63756d656e742e4368617261637465727328{1-25}29203d20{1-25}29205468656e::i;49662028416374697665446f63756d656e742e4368617261637465727328{1-25}202d203129203d20{1-25}29205468656e::i;416374697665446f63756d656e742e52616e676528::i;2e44656c657465::i;44696d20{3-25}2041732056617269616e740d0a{3-25}203d205368656c6c28{1-20}2c203029::i
MiscreantPunch.EvilDoc.Exploit.2017-11882.M3;Engine:81-255,Target:2;(0&(1|2)&3);02CE020000000000C000000000000046;4500710075006100740069006F006E0020004E00610074006900760065;4571756174696F6E2E33;0/\x02\xCE\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46.+?\x08.{2}(?:[^\x00]{0,36}(?:\.exe|(?:c(?:ertutil|script|md)|w(?:script|mic)|reg(?:svr32)?|powershell|schtasks|mshta)[\x20-\x2f\x3a-\x40\x5b-\x5e\x60\x7b-\x7f])|[^\x00]{36,}\x12\x0C\x43\x00)/si
MiscreantPunch.EvilDoc.Exploit.2017-11882.M4;Engine:81-255,Target:2;(0&1);02CE020000000000C000000000000046;0/\x02\xCE\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46.+?\x03[\x00\x01][\x00\x01]\x03\x0A.+?\x08.{2}[^\x00]{44}\x12\x0C\x43\x00/si
MiscreantPunch.EvilDoc.Exploit.2017-11882.M5;Engine:81-255,Target:2;(0&1);02CE020000000000C000000000000046*03(00|01)(00|01)030a0a0108;0/\x03[\x00\x01][\x00\x01]\x03\x0A\x0A\x01\x08.{2,100}(?:\.exe|(?:c(?:ertutil|script|md)|w(?:script|mic)|r(?:eg(?:svr32)?|undll32)|powershell|schtasks|mshta)\W)/si
MiscreantPunch.EvilMacro.MultiPSDL.171127;Engine:81-255,Target:2;(0&1&2&3&4>3&5&6);4174747269627574652056425f::i;20586f7220::i;2e47657428::i;2e43726561746520{3-25}28417272617928{2-3}2c20{2-3}2c20{2-3}2c20{2-3}2c20::i;2e57726974654c696e65::i;2e5265675772697465::i;5368656c6c20{3-25}28417272617928{2-3}2c20{2-3}2c20::i
MiscreantPunch.EvilMacro.ARRSHSTRRCNT.172711;Engine:81-255,Target:2;(0>30&1>30&2&3);4172726179::i;53747252657665727365::i;5368656c6c::i;2/Shell[^\w\r\n]{0,3}\s*(?:\x22\x22|\x27\x27|[A-Za-z])[^\n\x2c]+,\s*(?!(?:\s*[123456](?!(?:\s*[\x2a\x2d\x2b\x2f\x5e\x25]|\s*xor\b))|\s*vb(?:M(?:inimized(?:No)?|aximized)|Normal(?:No)?)Focus|\s*True))./si
MiscreantPunch.RTF.EvilRTF.CVE-2017-11882.M2;Target:0;(0&1&2);0:7b5c7274;3032434530323030303030303030303043303030303030303030303030303436*3330(30|31)30(30|31)30333061306130313038::ia;1/02CE020000000000C000000000000046.+?030[01]0[01]030A0A0108.{4,400}(?:2e657865|(?:7(?:7(?:736372697074|6d6963)|26567(?:7376723332)?|06f7765727368656c6c|363687461736b73)|6(?:3(?:6(?:572747574696c|d64)|736372697074)|d73687461)))/si
#MiscreantPunch.EvilMacro.SHRUNWINDOWMATH.172811;Engine:81-255,Target:2;((0|1)&(2|3)&4);2e72756e::i;7368656c6c::i;417474726962757465205642::i;44696d20::i;(0|1)/(?:\.run|shell)[^\r\n]+,\s*(?:vb(?:(?:M(?:inimized(?:No)?|aximized)|Normal(?:No)?)Focus|Hide)|(?:Fals|Tru)e|[0-9]+)\s+(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor)\s/i
MiscreantPunch.EvilMacro.SHRUNWINDOWMATH.182003;Engine:81-255,Target:2;((0|1)&2);417474726962757465205642*2e72756e::i;417474726962757465205642*7368656c6c::i;(0|1)/(?:\.run|(?<!\x28[\x22\27])\bshell)\b(?![\x22\x27]\s*\x29)(?:[\x22\x27]\s*\])?[\x21\x23\x25\x26\x2A\x2B\x2C\x2D\x3A\x3B\x3C\x3E\x3F\x40\x5B\x2F\x5D\x5F\x7B\x7C\x7D\x7E]{0,2}\s*\x28?\s*[\x22\x27A-Za-z][^\r\n\x2c]*,\s*\(?(?:vb(?:(?:M(?:inimized(?:No)?|aximized)|Normal(?:No)?)Focus|Hide)|(?:Fals|Tru)e|[0-9]+)\s+(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor)\s/i
MiscreantPunch.EvilMacro.ShellRunCells.171129;Engine:81-255,Target:2;(0&1&(2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21));4174747269627574652056425f::i;4372656174654f626a6563742822575363726970742e5368656c6c22292e52756e202843656c6c7328{1-4}2c20{1-4}2929::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.Emotet.171201;Engine:81-255,Target:2;(0&1>250&2>15&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;202b20::i;203d204172726179284c5472696d284c5472696d28::i;5642412e5368656c6c2420{5-25}2c2030::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.STRREVWSCRIPTEXEPRIME.170412;Engine:81-255,Target:2;(0&1&(2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21));73747272657665727365::i;74706972637377::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.ARSHELLSTRCON.170112;Engine:81-255,Target:2;((0|1)&(2>50|3>50|4>50|5>50)&(6>50)&7&8);4174747269627574652056425f::i;44696d20::i;2220262022::i;22202b2022::i;2720262027::i;27202b2027::i;3d20417272617928::i;5368656c6c::i;7/Shell[^\w\r\n]{0,3}\s*(?:\x22\x22|\x27\x27|[A-Za-z])[^\n\x2c]+,\s*(?!(?:\s*[123456](?!(?:\s*[\x2a\x2d\x2b\x2f\x5e\x25]|\s*xor\b))|\s*vb(?:M(?:inimized(?:No)?|aximized)|Normal(?:No)?)Focus|\s*True))./si
MiscreantPunch.RTF.EvilRTF.CVE-2017-11882.M3;Target:0;(0&1&(2|3|4|5)&6);0:7b5c7274;30303032434530323030303030303030303043303030303030303030303030303436*3330313031303330613061303830::i;5c6f626a757064617465;5c6f626a656d62;5c6f626a6175746c696e6b;5c6f626a6c696e6b;1/02CE020000000000C000000000000046.+?030[01]0[01]030A0A(?:01)?08.{0,200}(?:5(?:2(?:[46]5[46]7[57]3[57]6[57]2|[57]5[46]e[46]4[46]c[46]c)3332|7(?:[57]3[46]3[57]2[46]9[57]0[57]4|[46]d[46]9[46]3)|0[46]f[57]7[46]5[57]2[57]3[46]8[46]5[46]c[46]c|3[46]3[46]8[57]4[46]1[57]3[46]b[57]3)|7(?:2(?:[46]5[46]7[57]3[57]6[57]2|[57]5[46]e[46]4[46]c[46]c)3332|7(?:[57]3[46]3[57]2[46]9[57]0[57]4|[46]d[46]9[46]3)|0[46]f[57]7[46]5[57]2[57]3[46]8[46]5[46]c[46]c|3[46]3[46]8[57]4[46]1[57]3[46]b[57]3)|4(?:3(?:4(?:5[57]2[57]4[57]5[57]4[46]9[46]c|d[46]4)|6(?:5[57]2[57]4[57]5[57]4[46]9[46]c|d[46]4)|[57]3[46]3[57]2[46]9[57]0[57]4)|d[57]3[46]8[57]4[46]1)|6(?:3(?:4(?:5[57]2[57]4[57]5[57]4[46]9[46]c|d[46]4)|6(?:5[57]2[57]4[57]5[57]4[46]9[46]c|d[46]4)|[57]3[46]3[57]2[46]9[57]0[57]4)|d[57]3[46]8[57]4[46]1)|2e[46]5[57]8[46]5)/si
#MiscreantPunch.EvilMacro.SHRUNAPPDATAEXE.172811;Engine:81-255,Target:2;((0|1)&(2|3)&4);2e72756e::i;7368656c6c::i;417474726962757465205642::i;44696d20::i;(0|1)/(?:\.run|shell)[^\r\n]+\benviron\b[^\r\n]*\bappdata\b[^\r\n]*\.exe/i
MiscreantPunch.EvilMacro.MultiPSDL.171206;Engine:81-255,Target:2;(0&1>75&2>75&3>100&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;4368725728::i;202b204368725728::i;4368725728{1-3}202d20{1-3}2920::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilVBS.STRREVEXEFFOX.170712;Engine:81-255,Target:7;(0>10&1&2&3&4&5);64696d20::i;73747272657665727365::i;3a70747468::i;6578652e::i;6c6c6568732e74706972637377::i;2066697265666f782f::i
MiscreantPunch.EvilDoc.Exploit.2017-11882.M7;Engine:81-255,Target:2;(0&1);ffffffff02ce020000000000c000000000000046{0-50000}1c0000000200{0-50000}0000000003(00|01)(00|01)030a0a{0-1}085a5a;4571756174696F6E::iaw
MiscreantPunch.EvilMacro.MultiPSDL.171211;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;202b2043687228417363284d696428::i;203d20456e7669726f6e2428::i;43616c6c204372656174654f626a656374284170706c69636174696f6e2e52756e28::i;2e52756e28::i;43616c6c204170706c69636174696f6e2e52756e285265706c61636528::i;53747252657665727365::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.CHRSHELL.171211;Engine:81-255,Target:2;(0&1>50&2>150&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4368725728{1-3}202d20{1-3}292026204368725728{1-3}202d20{1-3}2920::i;26204368725728::i;5368656c6c::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.AOSTRARREXEPRIME.17112;Engine:81-255,Target:2;((0|1)&2&3&(4>10)&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24)&(25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44));4174747269627574652056425f::i;44696d20::i;64656372797074696f6e::i;6572726f72::i;417272617928537472696e6728::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.MultiPSL.171212;Engine:81-255,Target:2;(0&1&2&3&4&(5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24));4174747269627574652056425f::i;203d20417272617928::i;4170706c69636174696f6e2e52756e::i;23312f312f3139373023::i;496620{10-40}203e2031205468656e0d0a202020202020204372656174654f626a6563742822575363726970742e5368656c6c22292e52756e20{3-20}2c2030::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.AOSTRASCINUMCNTEXEPRIME.171212;Engine:81-255,Target:2;((0|1)&2>30&(3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22)&(23|24|25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42));417474726962757465205642::i;44696d20::i;(30|31|32|33|34|35|36|37|38|39|61|62|63|64|65|66|67|68|69|6a|6b|6c|6d|6e|6f|70|71|72|73|74|75|76|77|78|79|7a)(30|31|32|33|34|35|36|37|38|39|61|62|63|64|65|66|67|68|69|6a|6b|6c|6d|6e|6f|70|71|72|73|74|75|76|77|78|79|7a)22202b2022(30|31|32|33|34|35|36|37|38|39|61|62|63|64|65|66|67|68|69|6a|6b|6c|6d|6e|6f|70|71|72|73|74|75|76|77|78|79|7a)(30|31|32|33|34|35|36|37|38|39|61|62|63|64|65|66|67|68|69|6a|6b|6c|6d|6e|6f|70|71|72|73|74|75|76|77|78|79|7a)::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
#MiscreantPunch.EvilMacro.AOARRSEXEHIDEQONECHAR.171212;Engine:81-255,Target:2;((0|1)&2&(3|4)&5&6&7&8&9&10&11&12&(13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|32)&33);4174747269627574652056425f::i;64696d20::i;6172726179::i;72756e::i;7368656c6c::i;222f22::i;223a22::i;222e22::i;227822::i;226822::i;227422::i;227022::i;226522::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i;(3|4)/(?:(?<!\bapplication)\.run\b|\bshell\b)\s*\W{0,3}\s*(?:[A-Za-z]|\x22\x22|\x27\x27)[^\x2c]+\x2c\s*(?:0|False|vbHide|[1-9]+\s+(?:[\x2a\x2d\x2b\x2f\x5e\x25]|xor))/si
MiscreantPunch.EvilMacro.MSBUILDEXE.171214;Engine:81-255,Target:2;(0&1&(2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21));4174747269627574652056425f::i;5c4d534275696c642e65786520::i;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.MultiPSDL.171214;Engine:81-255,Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4372656174654f626a65637428::i;1/CreateObject\((?=[^\x29]*_)[^\x29]*\s[+&]\s/s;2e52756e20{1-30}2c20300d0a::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.XORGOCOOBFUS.171412;Engine:81-255,Target:2;(0&1&2&(3|4)&(5|6)&7&8);4372656174654f626a656374::i;4765744f626a656374::i;43687228417363284d6964::i;20786f7220::i;205e20::i;41747472627574652056425f::i;44696d20::i;0/CreateObject[\s_\r\n]*\([\s_\r\n]*(?=(\x22\x22|\x27\x27|[A-Za-z]))[^\x29]*\([\s_\r\n]*Array/si;1/GetObject[\s_\r\n]*\([\s_\r\n]*(?=(\x22\x22|\x27\x27|[A-Za-z]))[^\x29]*\([\s_\r\n]*Array[\s_\r\n]*/si
MiscreantPunch.EvilMacro.XOREXEENVTRIMFRM.171412;Engine:81-255,Target:2;((0|1)&(2|3)&4&5&6&7&8&(9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28));4174747269627574652056425f::i;44696d20::i;205e20::i;20786f7220::i;656e7669726f6e::i;5075742023::i;416374697665446f63756d656e742e53617665::i;7472696d::i;7/Trim\s*\([^\r\n]*\.(?:Text|Caption|Button)/si;2e72756e::i;7368656c6c::i;5348437265617465546872656164::i;52746c4d6f76654d656d6f7279::i;577269746550726f636573734d656d6f7279::i;57726974655669727475616c4d656d6f7279::i;43616c6c57696e646f7750726f63::i;456e756d5265736f757263655479706573::i;456e756d53797374656d4c616e677561676547726f757073::i;456e756d55494c616e677561676573::i;456e756d44617465466f726d617473::i;456e756d43616c656e646172496e666f::i;456e756d54696d65466f726d617473::i;5348437265617465546872656164::i;47726179537472696e67::i;43726561746554696d6572517565756554696d6572::i;43726561746550726f63657373::i;57696e33325f50726f63657373::i;4d6163536372697074::i;57696e45786563::i
MiscreantPunch.EvilMacro.MultiPSDL.171215;Engine:81-255,Target:2;(0&1&2&3&(4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23));4174747269627574652056425f::i;4170706c69636174696f6e2e52756e20::i;1/Application\.Run\s*[^,]+\,\s*[a-z]{3,13}\s*&\s*(?:\s*[a-z]{3,13}\s*&\s*){20,}\s*[a-z]{3,13}/si;4372656174654f626a6563742822577363726970742e5368656c6c22292e52756e20{1-25}2c2030::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MacPythonB64Exec.171215;Engine:81-255,Target:2;(0&1&2&3&4&5&6&(7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26));4174747269627574652056425f::i;4d6163536372697074::i;707974686f6e::i;696d706f727420626173653634::i;737973::if;6578656328::i;6261736536342e6236346465636f646528::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.LargeArrayChrShell;Engine:81-255,Target:2;(0&1&2&3);4174747269627574652056425f::i;203d20417272617928::i;1/[0-9]{2,3}\s*\,\s*(?:\s*[0-9]{2,3}\s*\,\s*_?){100,}[0-9]{2,3}\)/si::i;5368656c6c::i
MiscreantPunch.EvilMacro.MultiPSDL.171218;Engine:81-255,Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;49662030203d::i;5368656c6c::i;20436872::i;44696d20::i;1/If 0 =[\r\n\s_]*(?P<var>[A-Za-z][A-Za-z0-9_-]+)[\r\n\s_]*Then.+?Shell[^\x2c]*\x2c[\r\n\s_]*(?P=var)\b/si
MiscreantPunch.EvilMacro.Ursnif.171220;Engine:81-255,Target:2;(0&1&(2|3));436776646e74203d20436776646e74202b20436872242863696a29::i;7368656c6c::i;44696d20::i;4174747269627574652056425f::i
MiscreantPunch.PHISH.DocuSignMultiMail.172112;Engine:81-255,Target:3;(0&1&2&3);22776f726b6c6f61645f6e616d65223e414f4c3c2f7370616e3e::i;22776f726b6c6f61645f6e616d65223e4f75746c6f6f6b3c2f7370616e3e::i;22776f726b6c6f61645f6e616d65223e4f7468657220456d61696c3c2f7370616e3e::i;3c7469746c653e*446f63757369676e*3c2f7469746c653e::i
PhishPunch.Chalbhai.181102;Engine:81-255,Target:3;(0&1);2e706870206e616d653d::i;0/\.php\sname=[a-z0-9]+\sid=[a-z0-9]+\smethod=post/
MiscreantPunch.AORBUILTINDPROPS.180101;Engine:81-255,Target:2;(0&1&(2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21));4174747269627574652056425f*2e72756e*4275696c74496e446f63756d656e7450726f70657274696573::i;0/(?<!\bapplication)\.run\b[^\r\n\x2c\x00]+\bBuiltInDocumentProperties/i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilMacro.MultiPSDL.180102;Engine:81-255,Target:2;(0&1&2&3&4>50&5>1000&(6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25));4174747269627574652056425f::i;4c696220225553457233322220416c69617320224765744465736b746f7057696e646f772220::i;4c696220226b65724e454c33322220416c696173202248656170416c6c6f632220::i;4c696220226b65724e454c33322220416c6961732022577269746550726f636573734d656d6f727922::i;43616c6c20::i;29203d20;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.Suspicious.RemoteSubDocCall;Engine:81-255,Container:CL_TYPE_ZIP,Target:7;(0&1&2&3);3c72656c6174696f6e73686970::i;7461726765746d6f6465::i;737562446f63756d656e74::i;0/\<relationship(?=(?:(?!\/>).)+?targetmode\s*=\s*[\x22\x27]?\s*external)(?=(?:(?!\/>).)+?type\s*=\s*[\x22\x27][^\x22\x27\s]+\/subDocument)(?:(?!\/>).)+?target\s*=\s*[\x27\x22]?\s*(?:(?:file\:)?[\x2f\x5c]+[^\x5c\x2f\x22\x27]{2}(?<![\x5c\x2fA-Za-z]\x3a)|https?\x3a|ftp\x3a)/si
MiscreantPunch.EvilDoc.Exploit.2017-11882.M8;Engine:81-255,Target:2;(0&1);ffffffff02ce020000000000c000000000000046{0-50000}1c0000000200{0-50000}0000000003(00|01)(00|01)03{0-40}31D0{0-40}9090909090909090;4571756174696F6E::iaw
MiscreantPunch.EvilMacro.URSNIF.180108;Engine:81-255,Target:2;((0|1)&2);44696d20::i;4174747269627574652056425f::i;49662062696e203d206c6e726f205468656e*202b204368722428*456e64204966*4e657874*202b2069*202d31202a20
MiscreantPunch.EvilMacro.MultiPSDL.180110;Engine:81-255,Target:2;(0&1&2&3&4);4174747269627574652056425f::i;203d20224d53584d4c322e444f4d446f63756d656e7422::i;203d204368722428{1-4}202d20{1-4}292026204368722428{1-4}202d20{1-4}292026204368722428{1-4}202d20{1-4}292026204368722428{1-4}202d20{1-4}292026204368722428::i;203d204372656174654f626a65637428::i;5368656c6c20::i
MiscreantPunch.EvilMacro.CertUtilDL.180110;Engine:81-255,Target:2;(0&1&2&3&4&5);4174747269627574652056425f::i;203d20456e7669726f6e282274656d702229202620::i;203d204372656174654f626a6563742822536372697074696e672e46696c6553797374656d4f626a6563742229::i;2e57726974654c696e65::i;2e4372656174655465787446696c6528::i;2e52756e2022636d642e657865202f6320636572747574696c202d6465636f6465202574656d70255c::i
MiscreantPunch.EvilMacro.Hancitor.180110;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7);4174747269627574652056425f::i;4c696220226e74646c6c2220416c696173::i;224e7457726974655669727475616c4d656d6f727922::i;224e74416c6c6f636174655669727475616c4d656d6f727922::i;224b65726e656c333222::i;57696e3634::i;23456e64204966::i;2e56616c7565203d20446179282331322f352f323031332329::i
MisreantPunch.EvilDoc.CVE-2017-11882.M9;Engine:81-255,Target:2;(0);030101030A0D01BBBBBBBB03150000010802009B5858585858585858585804D9C1C8080409C1C8080402C1C8108BD09B8B029B8B089B9B8B099B83C13C83C13C83C13C9BFFE19B9B9B202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202500
MiscreantPunch.Evil.PPTX.CVE-2017-8570.M2;Engine:81-255,Container:CL_TYPE_ZIP,Target:0;(0&1&2&3);3c52656c6174696f6e73686970::i;5461726765744d6f6465::i;45787465726e616c::i;0/<Relationship(?=[^>]+Target\s*=\s*[\x22\x27]?script(?:let)?\x3a(?:https?|ftp))[^>]+TargetMode\s*=\s*[\x22\x27]?External/si
MiscreantPunch.EvilMacro.CVE-2018-0802.DropperDoc;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&10&(11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30));4174747269627574652056425f::i;203d20456e7669726f6e24282254454d502229::i;203d204372656174654f626a6563742822576f72642e4170706c69636174696f6e2229::i;2e56697369626c65203d2046616c7365::i;2e446f63756d656e74732e4f70656e28::i;5368656c6c2028::i;2e51756974::i;416374697665446f63756d656e742e536176654173::i;46696c65466f726d61743a3d7764466f726d6174525446::i;2e727466::i;2e6578::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Exploit.CVE-2018-0802.M1;Engine:81-255,Target:2;(0&1&2);ffffffff02ce020000000000c000000000000046{0-50000}1c0000000200{0-50000}0000000003(00|01)(00|01)030a0a{151-152}2500;4571756174696F6E::iaw;0/\x00\x00\x00\x00\x03[\x00\x01][\x00\x01]\x03\x0a\x0a.{0,1}\x08.{150}\x25\x00/s
MiscreantPunch.EvilDoc.CVE-2017-11882.M10;Engine:81-255,Target:2;(0&1);ffffffff02ce020000000000c000000000000046{0-50000}1c0000000200{0-50000}0000000003(00|01)(00|01)030a(0a|0d){2-152}25746D7025(5c|2f)::i;4571756174696F6E::iaw
MiscreantPunch.EvilMacro.MultiPSDL.180116;Engine:81-255,Target:2;(0&1&2&3&4&5&6&7&8&9&(10|11|12|13|14|15|16|17|18|19|20|21|22|23|24|25|26|27|28|29));4174747269627574652056425f::i;4d7367426f782022436f70797269676874206279204d6963726f736f667422::i;203d20456e7669726f6e2428::i;43687228417363284d696428::i;43616c6c204372656174654f626a656374284170706c69636174696f6e2e52756e28::i;203d20227722::i;203d20227322::i;203d20227322::i;203d20227322::i;203d205265706c61636528::i;496e6b50696374757265315f5061696e746564::i;4175746f45786563::i;4175746f4f70656e::i;4175746f5f4f70656e::i;4175746f436c6f7365::i;4175746f5f436c6f7365::i;4175746f45786974::i;4175746f4e6577::i;446f63756d656e744f70656e::i;446f63756d656e745f4f70656e::i;446f63756d656e74436c6f7365::i;446f63756d656e745f436c6f7365::i;446f63756d656e744265666f7265436c6f7365::i;446f63756d656e744368616e6765::i;446f63756d656e745f4e6577::i;4e6577446f63756d656e74::i;576f726b626f6f6b5f4f70656e::i;576f726b626f6f6b4f70656e::i;576f726b626f6f6b5f4163746976617465::i;576f726b626f6f6b5f436c6f7365::i
MiscreantPunch.EvilDoc.Exploit.2017-11882.M11;Engine:81-255,Target:2;(0&1);085A5AB844EB7112BA7856341231D08B088B098B096683C13C;4571756174696F6E::iaw
MiscreantPunch.EvilDoc.Exploit.2017-11882.M12;Engine:81-255,Target:2;(0&1);085A5A33C099B202C1E2082BE2E8FFFFFFFFC35B50648B40308B400899B203C1E21066BA120C03C28D5B1C53FFE063;4571756174696F6E::iaw
MiscreantPunch.EvilMacro.IEXB64.1;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;6c4665436862
MiscreantPunch.EvilMacro.IEXB64.2;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;705a56676f57
MiscreantPunch.EvilMacro.IEXB64.3;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;705a58676f57
MiscreantPunch.EvilMacro.IEXB64.4;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;535556;4/SUV[4Y]KF/
MiscreantPunch.EvilMacro.IEXB64.5;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;615756;4/aWV[4Y]KF/
MiscreantPunch.EvilMacro.IEXB64.6;Engine:81-255,Target:2;((0|1|2|3)&4&5);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;615556;4/aUV[4Y]KF/
MiscreantPunch.EvilMacro.IEXB64.7;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;6c6c57436862
MiscreantPunch.EvilMacro.IEXB64.8;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;4a5256676f57
MiscreantPunch.EvilMacro.IEXB64.9;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;6c4657436862
MiscreantPunch.EvilMacro.IEXB64.10;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;705256676f57
MiscreantPunch.EvilMacro.IEXB64.11;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;4a5a58676f57
MiscreantPunch.EvilMacro.IEXB64.12;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;4a5a56676f57
MiscreantPunch.EvilMacro.IEXB64.13;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;4a5258676f57
MiscreantPunch.EvilMacro.IEXB64.14;Engine:81-255,Target:2;((0|1|2|3)&4);417474726962757465205642::i;44696d20::i;5c564245372e444c4c::aw;5c564245362e444c4c::aw;705258676f57