MALPEDIA_Win_Gooseegg_Auto

rule MALPEDIA_Win_Gooseegg_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8132454-9f6e-5d45-ae4a-e06046e4b7c3"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gooseegg"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.gooseegg_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "8983b8f0c526551207a00c2d480777794912cb3a61999ef4b05b249edd7a0003"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4d85c9 488d3d797c0000 488bc2 4c8bfa 4d0f45d1 4885d2 418d6b01 }
		$sequence_1 = { 488d05f1550100 c3 488d05f1550100 c3 4883ec28 e8???????? }
		$sequence_2 = { eb02 33db 4c8d357194ffff 4885db }
		$sequence_3 = { ff15???????? 48832300 4883c308 488d05b9440100 483bd8 }
		$sequence_4 = { 488d35abe70000 48895c2420 488d056fff0000 483bd8 7419 483933 740e }
		$sequence_5 = { 488b05???????? 488d150ef7ffff 483bc2 7423 65488b042530000000 }
		$sequence_6 = { 4c8d0dd17b0000 33c9 4c8d05c47b0000 488d15c57b0000 e8???????? 4885c0 740b }
		$sequence_7 = { 488945e0 895128 488d0dbb940000 488b45d8 488908 488d0d0d190100 488b45d8 }
		$sequence_8 = { 8bfb e9???????? e8???????? 488d1df2370100 }
		$sequence_9 = { 85c0 0f849e000000 4c8d051f330100 ba00020000 }

	condition:
		7 of them and filesize < 217088
}