JSSLoader yara sig

rule JssHttp_loader_bin
{
    meta:
        description = "JssLoader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/b6f6bfe1-c483-46c5-8abc-899c1e08f5d5"
        date = "2019/10"
        maltype = "Loader"

    strings:
        $string1 = "JssHttp"
        $string2 = "Host information report" wide
        $string3 = "End of report" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 100KB
}

rule JssHttp_loader_mem
{
    meta:
        description = "JssLoader"
        author = "James_inthe_box"
        reference = "https://app.any.run/tasks/b6f6bfe1-c483-46c5-8abc-899c1e08f5d5"
        date = "2019/10"
        maltype = "Loader"

    strings:
        $string1 = "JssHttp"
        $string2 = "Host information report" wide
        $string3 = "End of report" wide

    condition:
        all of ($string*) and filesize > 100KB
}