include "demobis.yar"

import "modname"


private global rule Test : tag1 tag2 {

    meta:
        desc_0 = "abc"
        desc_1 = 123
        desc_2 = true
        desc_3 = false
        desc_z = ""

    strings:
        $text = "value"
        $text_b = "value" wide ascii fullword private xor(0x12)
        $re = /hash: [0-9a-fA-F]{32}/
        $re_b = /hash: [0-9a-fA-F]{32}/ wide ascii nocase fullword private
        $hex = { AA bb [2-4] 61 62 63 }
        $hex_b = { AA bb [2-4] 61 62 63 } private

    condition:
        filesize == 123 and entrypoint == 456 and for all of ($text*) : ( @ > @hex_b ) and any of them

}