Cmay Virus Detection

This YARA rule detects the Cmay virus by looking for specific byte sequences within the Portable Executable (PE) file. It checks for two distinct bodies of code, '$cmay_body_1' and '$cmay_body_2', with '$cmay_body_1' specifically required to be present at the entry point of the PE file. The rule also verifies that the file starts with the 'MZ' magic bytes (0x5A4D), indicating a valid Windows executable.