Arma VM Detector yara sig

rule Arma_vmdetector_bin
{
    meta:
        description = "Arma VM Detector"
        author = "James_inthe_box"
        reference = "8ac05c6a588e6421b7de21aebaf2dbfeb3334d4ebf17caf6d5705874c0a72c5e"
        date = "2019/03"
        maltype = "Support"

    strings:
        $string1 = "arma.VmDetector.Win32"
        $string2 = "INFINITE"
        $string3 = "BIOS"
        $string4 = "BIOS_ROM_is_socketed"
        $string5 = "BIOS_shadowing_is_allowed"
        $string6 = "OEMStringArray" wide
        $string7 = "RegAsm.exe" wide
	$string8 = "/c copy" wide


    condition:
        uint16(0) == 0x5A4D and uint8(uint32(0x3c)+23) == 0x21 and all of ($string*) and filesize < 100KB
}

rule Arma_vmdetector_mem
{
    meta:
        description = "Arma VM Detector"
        author = "James_inthe_box"
        reference = "8ac05c6a588e6421b7de21aebaf2dbfeb3334d4ebf17caf6d5705874c0a72c5e"
        date = "2019/03"
        maltype = "Support"

    strings:
        $string1 = "arma.VmDetector.Win32"
        $string2 = "INFINITE"
        $string3 = "BIOS"
        $string4 = "BIOS_ROM_is_socketed"
        $string5 = "BIOS_shadowing_is_allowed"
        $string6 = "OEMStringArray" wide
        $string7 = "RegAsm.exe" wide
        $string8 = "/c copy" wide


    condition:
        all of ($string*) and filesize > 100KB
}