MSCopyrightFail

rule Methodology_VersionEngine_MSCopyrightFail
{
    meta:
        author = "smiller"
        date = "05/15/2019"
        description = "This rule looks for a MS copyright string without a terminating period character, which may indicate some manual typing and probably not actually MS."
        md5 = "98c72d96350a022fd8e486f9cbcca018"
    strings:
        $hex = { 01 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9 00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F 00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20 00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72 00 76 00 65 00 64 00 00 00 00 00 }
    condition:
        (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and $hex
}