rule win_Emmenhtal_w0 {
    meta: 
        author = "cert-orangecyberdefense"
        source = "https://raw.githubusercontent.com/cert-orangecyberdefense/emmenhtal/main/yara%20Emmenhtal"
        date = "2024-08-14"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emmenhtal"
        malpedia_rule_date = "20240814"
        malpedia_hash = ""
        malpedia_version = "20240814"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $s1 = " = String.fromCharCode("
        $s2 = ";var "
        $s3 = "eval("
        $s4 = "</script>"
        $s5 = "<HTA:APPLICATION CAPTION = \"no\" WINDOWSTATE = \"minimize\" SHOWINTASKBAR = \"no\" >"
    condition:
        all of them
}