MALPEDIA_Win_Octowave_Auto

rule MALPEDIA_Win_Octowave_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "85414a71-9137-581f-9bba-b22bd8bc0186"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.octowave"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.octowave_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "604ff06a585ef27202c35c7e4b47bd9528bd6c469f90955aee6f71ff2a73e229"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f786c46d000000020000 7426 8d4bff 8bc5 0faf8ed46c0000 2bc1 83f80a }
		$sequence_1 = { ff7704 68???????? 56 e8???????? ff7708 68???????? 56 }
		$sequence_2 = { f30f70c0d8 660f70c0d8 0f5405???????? 660f67c0 660f7e0413 660f6ec0 8d4104 }
		$sequence_3 = { ffd0 8b4710 83c418 8b4c241c 0fafc3 894f1c 5d }
		$sequence_4 = { ff5038 8b4d14 8bf0 8b01 ff5038 8bc8 8b450c }
		$sequence_5 = { f30f5dd0 0f28c2 f30f5fc1 f30f110410 8b44242c f30f5c1410 0f2f15???????? }
		$sequence_6 = { ff742470 ff742440 6a02 ff74245c ff74246c e8???????? 8bce }
		$sequence_7 = { f30f59c3 f30f1100 03c1 836dec01 75a7 8b750c 8b5d10 }
		$sequence_8 = { f30f5cc8 f30f10423c f30f59463c 83c640 f30f58d1 f30f5cd0 0f5ac2 }
		$sequence_9 = { ff10 8d4c2408 e8???????? 8b442408 80780d00 74e0 8d4e04 }

	condition:
		7 of them and filesize < 7258112
}