Yara rule - macro_sheet_zloader

rule macro_sheet_obfuscated_char
{
		meta:
				description = "Finding hidden/very-hidden macros with many CHAR functions"
				Author = "DissectMalware"
				Sample = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b (Zloader)"
        strings:
                $ole_marker = {D0 CF 11 E0 A1 B1 1A E1}
                $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
                $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
                $char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}
        condition:
                $ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func > 10

}