import "hash"

rule bulwark_https_bulwarkblack_com_tamperedchef_signed_productivity_apps_malware_defense
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/tamperedchef-signed-productivity-apps-malware-defense/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:57:38Z"
        tlp = "TLP:CLEAR"
        indicator_count = "6"
    strings:
        $s0 = "onezipapp.com" ascii wide nocase  // Domains
        $s1 = "www.crystalpdf.com" ascii wide nocase  // Domains
        $s2 = "crystalpdf.com/conditions" ascii wide nocase  // URLs
        $s3 = "https://www.crystalpdf.com/conditions" ascii wide nocase  // URLs
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "2231bfa7c7bd4a8ff12568074f83de8e4ec95c226230cccc6616a1a4416de268" or
        hash.sha256(0, filesize) == "248de1470771904462c91f146074e49b3d7416844ec143ade53f4ac0487fdb44"
}