684b95b69197bfae5713291266e465cc677026be.yar

rule INDICATOR_EXE_Packed_SmartAssembly {   
       meta:   
           author = "ditekSHen"   
           description = "Detects executables packed with SmartAssembly"   
       strings:   
           $s1 = "PoweredByAttribute" fullword ascii   
           $s2 = "SmartAssembly.Attributes" fullword ascii   
           $s3 = "Powered by SmartAssembly" ascii   
       condition:   
           uint16(0) == 0x5a4d and 2 of them   
   }