5a71a5fdc29d9a30b1a8e4621f14d594fab1f4f6.yar

import "pe"
rule INDICATOR_EXE_Packed_VMProtect {   
       meta:   
           author = "ditekSHen"   
           description = "Detects executables packed with VMProtect."   
           snort2_sid = "930049-930051"   
           snort3_sid = "930017"   
       strings:   
           $s1 = ".vmp0" fullword ascii   
           $s2 = ".vmp1" fullword ascii   
       condition:   
           uint16(0) == 0x5a4d and all of them or   
           for any i in (0 .. pe.number_of_sections) : (   
               (   
                   pe.sections[i].name == ".vmp0" or   
                   pe.sections[i].name == ".vmp1"   
               )   
           )   
   }