packed with Zutto Dekiru

Nobody has claimed this yet.

## Rule name

`packed with Zutto Dekiru`

## Summary

Contain Zutto Dekiru encoded content. Zutto Dekiru is a XOR-based encoder commonly seen used for shellcode.

## Possible test samples

Publicly available samples that may contain the capability this rule should detect (MD5 hashes):
- 311617bd1baa427bc37dee179e87413c
- 3a2152d179e689bf56fde34d77faf01d

## References

Links or references to additional information on the capability (can also be included in the rule):

- The Zutto Dekiru Encoder, Explained: https://www.boozallen.com/c/insight/blog/the-zutto-dekiru-encoder-explained.html
- Metasploit's source code: https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x64/zutto_dekiru.rb

## Namespace

Proposed namespace: `anti-analysis/packer/zutto-dekiru`. More details in https://github.com/fireeye/capa-rules/blob/master/doc/format.md#rule-namespace

## att&ck

`aka.mitre.att&ck.t1027`

Start with the rule format documentation linked in the issue and review the Metasploit zutto_dekiru.rb encoder source to understand the encoded content. Use the two listed MD5 samples as validation targets, and consider the work complete when the anti-analysis/packer/zutto-dekiru rule detects the stated capability without unrelated matches.

Written by the indexing model from the issue text.