5e595c4db339e82a317f9c72a0eda084e9d44f94.yar

rule INDICATOR_EXE_Packed_Dotfuscator {   
       meta:   
           author = "ditekSHen"   
           description = "Detects executables packed with Dotfuscator"   
       strings:   
           $s1 = "DotfuscatorAttribute" fullword ascii   
       condition:   
           uint16(0) == 0x5a4d and 1 of them   
   }