apt_nobelium_nativezone_gen [yara_rules]

pe.DLL and
        filesize < 2500KB and
        pe.number_of_exports > 20 and
        pe.number_of_imports < 30 and
        (
        pe.imports("kernel32.dll", "VirtualAlloc") and
        pe.imports("kernel32.dll", "VirtualProtect")
        ) and for any i in (0..pe.number_of_sections - 1):
        ( pe.sections[i].name == ".rdata" and
        pe.sections[i].raw_data_size > 300000 )
        and #obs > 300
        and #nobs < 150
        and not $rich