Jinnos yara

rule Jinnos_bin
{
    meta:
        description = "Jinnos cert"
        author = "James_inthe_box"
        reference = "ad6fb78b5e7f29f170503a0603efa94d8aa53ae5bae7a88377516949b7fb2ffa"
        date = "2019/02"
        maltype = "Various"

    strings:
        $string1 = "211110000000Z0b1"
        $string2 = "Jinnos soft1"
        $string3 = "External calculator"
        $string4 = "240218074704Z0A1"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 2MB
}