MALPEDIA_Win_Plugx_Auto

rule MALPEDIA_Win_Plugx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ca342e84-019e-549b-8251-0df01eb8ca92"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.plugx_auto.yar#L1-L240"
		license_url = "N/A"
		logic_hash = "63b0360a3b5c86169b64a94cf74635165b32fcd027b6ceab627a8a904b59c676"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 55 8bec 8b450c 81780400710000 }
		$sequence_1 = { 51 53 6a00 6a00 6a02 ffd0 85c0 }
		$sequence_2 = { 55 8bec 51 0fb74612 }
		$sequence_3 = { 55 8bec a1???????? 83ec5c 53 }
		$sequence_4 = { 0145f4 8b45fc 0fafc3 33d2 }
		$sequence_5 = { 51 56 57 6a1c 8bf8 e8???????? }
		$sequence_6 = { 33d2 f7f3 33d2 8945fc }
		$sequence_7 = { 41 3bca 7ce0 3bca }
		$sequence_8 = { e8???????? 3de5030000 7407 e8???????? }
		$sequence_9 = { e8???????? 85c0 7508 e8???????? 8945fc }
		$sequence_10 = { 85c0 7413 e8???????? 3de5030000 }
		$sequence_11 = { 50 ff15???????? a3???????? 8b4d18 }
		$sequence_12 = { e8???????? 85c0 7407 b84f050000 }
		$sequence_13 = { e8???????? 85c0 750a e8???????? 8945fc }
		$sequence_14 = { 85c0 750d e8???????? 8945f4 }
		$sequence_15 = { 51 6a00 6800100000 6800100000 68ff000000 6a00 6803000040 }
		$sequence_16 = { 50 ff75e8 6802000080 e8???????? }
		$sequence_17 = { 6808020000 6a00 ff74242c e8???????? }
		$sequence_18 = { 50 56 ffb42480000000 ff15???????? }
		$sequence_19 = { 89442424 8b442424 6808020000 6a00 }
		$sequence_20 = { 89742434 89f1 8b442434 e8???????? }
		$sequence_21 = { 5d c21000 55 53 57 56 83ec18 }
		$sequence_22 = { 6a5c ff74241c e8???????? 83c408 }
		$sequence_23 = { ba80969800 52 50 51 e8???????? }
		$sequence_24 = { c6410c00 e8???????? ffd0 83c420 }
		$sequence_25 = { bbe6000000 89d7 83e219 f7d7 21df 09fa }
		$sequence_26 = { 6a00 ff74245c e8???????? 83c40c }

	condition:
		7 of them and filesize < 1284096
}