Update APT_Dubnium.yar

Fixed style  rule

malware/APT_Dubnium.yar

@@ -7,35 +7,45 @@
 
 /* Rule Set ----------------------------------------------------------------- */
 
-rule Dubnium_Sample_1 {
+rule Dubnium_Sample_1
+{
+
     meta:
         description = "Detects sample mentioned in the Dubnium Report"
         author = "Florian Roth"
         reference = "https://goo.gl/AW9Cuu"
         date = "2016-06-10"
         hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+
     strings:
         $key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
         $key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
+
     condition:
         uint16(0) == 0x5a4d and filesize < 2000KB and all of them
 }
 
-rule Dubnium_Sample_2 {
+rule Dubnium_Sample_2
+{
+
     meta:
         description = "Detects sample mentioned in the Dubnium Report"
         author = "Florian Roth"
         reference = "https://goo.gl/AW9Cuu"
         date = "2016-06-10"
         hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+
     strings:
         $x1 = ":*:::D:\\:c:~:" fullword ascii
         $s2 = "SPMUVR" fullword ascii
+
     condition:
         ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
 }
 
-rule Dubnium_Sample_3 {
+rule Dubnium_Sample_3
+{
+
     meta:
         description = "Detects sample mentioned in the Dubnium Report"
         author = "Florian Roth"
@@ -44,6 +54,7 @@ rule Dubnium_Sample_3 {
         hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
         hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
         hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
+
     strings:
         $x1 = "copy /y \"%s\" \"%s\" " fullword ascii
         $x2 = "del /f \"%s\" " fullword ascii
@@ -51,11 +62,14 @@ rule Dubnium_Sample_3 {
         $s2 = "if exist \"%s\" goto Rept " fullword ascii
         $s3 = "\\*.*.lnk" fullword ascii
         $s4 = "Dropped" fullword ascii
+
     condition:
         uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
 }
 
-rule Dubnium_Sample_5 {
+rule Dubnium_Sample_5
+{
+
     meta:
         description = "Detects sample mentioned in the Dubnium Report"
         author = "Florian Roth"
@@ -71,14 +85,18 @@ rule Dubnium_Sample_5 {
         hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
         hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
         hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+
     strings:
         $s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
         $s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
+
     condition:
         uint16(0) == 0x5a4d and filesize < 9000KB and all of them
 }
 
-rule Dubnium_Sample_6 {
+rule Dubnium_Sample_6
+{
+
     meta:
         description = "Detects sample mentioned in the Dubnium Report"
         author = "Florian Roth"
@@ -88,15 +106,19 @@ rule Dubnium_Sample_6 {
         hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
         hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
         hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+
     strings:
         $s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
         $s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
         $s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
+
     condition:
         uint16(0) == 0x5a4d and filesize < 4000KB and all of them
 }
 
-rule Dubnium_Sample_7 {
+rule Dubnium_Sample_7
+{
+
     meta:
         description = "Detects sample mentioned in the Dubnium Report"
         author = "Florian Roth"
@@ -111,14 +133,18 @@ rule Dubnium_Sample_7 {
         hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
         hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
         hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+
     strings:
         $s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
         $s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
+
     condition:
         uint16(0) == 0x5a4d and filesize < 9000KB and all of them
 }
 
-rule Dubnium_Sample_SSHOpenSSL {
+rule Dubnium_Sample_SSHOpenSSL
+{
+
     meta:
         description = "Detects sample mentioned in the Dubnium Report"
         author = "Florian Roth"
@@ -130,9 +156,12 @@ rule Dubnium_Sample_SSHOpenSSL {
         hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
         hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
         hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+
     strings:
         $s1 = "sshkeypairgen.exe" fullword wide
         $s2 = "OpenSSL: FATAL" fullword ascii
+
     condition:
         uint16(0) == 0x5a4d and filesize < 9000KB and all of them
 }
+