34e6f540d7b09b9c6db96a61e713ecf0827fc7fb.yar

rule INDICATOR_EXE_Packed_aPLib {   
       meta:   
           author = "ditekSHen"   
           description = "Detects executables packed with aPLib."   
       strings:   
           $header = { 41 50 33 32 18 00 00 00 [0-35] 4D 38 5A 90 }   
       condition:   
           ((uint32(0) == 0x32335041 and uint32(24) == 0x905a384d) or (uint16(0) == 0x5a4d and $header ))   
   }