MALPEDIA_Win_Duqu_Auto

rule MALPEDIA_Win_Duqu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1b7ddae2-9d4f-55d9-a33a-8e02d1c0d30f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.duqu_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "b1c4299b66f23ea612df73dceb823e0a0151b3112b55ca56ad9d74306040c982"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83e007 c1e009 05270ca208 0faf442420 33c1 42 }
		$sequence_1 = { 53 56 57 e8???????? 8bf0 ba5b553fbc }
		$sequence_2 = { e8???????? 8bd8 8d442438 6a01 }
		$sequence_3 = { 8b442420 33d9 8b4c2414 40 49 89442420 894c2414 }
		$sequence_4 = { 56 51 8bf2 e8???????? }
		$sequence_5 = { 0fafc3 33c1 46 8bd8 4a 8a06 84c0 }
		$sequence_6 = { e8???????? 894620 85c0 0f84f6010000 baec8ce154 }
		$sequence_7 = { 1bc0 f7d0 21442414 8d442430 50 ff5324 }
		$sequence_8 = { ff9088000000 8bd6 8bc8 e8???????? 5e }
		$sequence_9 = { 8bd3 8bf1 e8???????? 8b75fc }
		$sequence_10 = { 8bd3 e8???????? 8b15???????? 33c9 }
		$sequence_11 = { 8bec 51 a1???????? 56 8b35???????? 57 6a19 }
		$sequence_12 = { 8bd3 8bcf e8???????? 85c0 7405 33c0 }
		$sequence_13 = { 8bd3 8d4900 0fb641fe 0fb669ff }
		$sequence_14 = { 8bd3 8bcf ff542424 8b4708 }
		$sequence_15 = { 8bd3 ff542424 3bee 75af }

	condition:
		7 of them and filesize < 18759680
}