MALPEDIA_Win_Oddjob_Auto

rule MALPEDIA_Win_Oddjob_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e56ada75-c957-524c-8aa7-1b282aea730b"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oddjob"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.oddjob_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "915f827e297dcef6713c32c245190ad2b96f0b86022640796013bd5fdaca18ef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c685f8fcffff8a 889df9fcffff 889dfafcffff 889dfbfcffff c685fcfcffff5b c685fdfcffff53 c685fefcffff8b }
		$sequence_1 = { c685d2faffff02 c685d3fafffff3 c685d4faffffab c685d5faffff89 c685d6faffffd1 c685d7faffff83 }
		$sequence_2 = { c68595fdffff81 c68596fdffffce 889d97fdffff c68598fdffff02 889d99fdffff 889d9afdffff c6859bfdffff8b }
		$sequence_3 = { 6a06 33c0 837dfc00 59 8bfe f3ab }
		$sequence_4 = { 57 57 57 ff75f4 8975f8 ff15???????? }
		$sequence_5 = { 8d95ecfeffff 8bcf 8d8530ffffff e8???????? 59 8d85a8feffff }
		$sequence_6 = { 0f853cfeffff 83c304 f685f8fbffff20 741c f685f8fbffff40 899de8fbffff 7406 }
		$sequence_7 = { 56 668985a8c4ffff 8d85aac4ffff 53 50 e8???????? 33c0 }
		$sequence_8 = { c68524fcffff59 c68525fcffff66 c68526fcffff59 c68527fcffff8b c68528fcffff46 c68529fcffff0c c6852afcffff85 }
		$sequence_9 = { 51 e8???????? 83c40c 8bfe 85db 761c }

	condition:
		7 of them and filesize < 221184
}