MALPEDIA_Win_Poohmilk_Auto

rule MALPEDIA_Win_Poohmilk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "483e4fcf-1f3d-5e75-bbef-a7bb7c4c805d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poohmilk"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.poohmilk_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "490defb91f075ad3ae75dd04962c4d29229e5802c0b4c23586aa7787b6607d3f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8d85ecfdffff 50 ffd7 8d8dc8fbffff 51 8d95ecfdffff }
		$sequence_1 = { 8b5738 8b4230 6a00 51 56 50 }
		$sequence_2 = { ff15???????? 85c0 0f84b9000000 8b542410 8d442414 50 }
		$sequence_3 = { 0f838d000000 0fbe8818344100 3bf1 7346 8b9564ffffff }
		$sequence_4 = { e8???????? 8be5 5d c3 8bbd98fbffff 8d8decfdffff }
		$sequence_5 = { 6880000000 6a03 6a00 6a07 6800000080 56 ff15???????? }
		$sequence_6 = { bb90010000 f7fb 85d2 740d 8bc6 c1e002 8bb0b0724100 }
		$sequence_7 = { 3304bdb8314100 c1e904 8bf8 83e70f }
		$sequence_8 = { 0fb63e 0fb6c0 eb12 8b45e0 8a80fc7b4100 08443b1d }
		$sequence_9 = { 3bcf 0f85f9000000 03de 11bd68d2ffff 29b594d2ffff 8b8594d2ffff }

	condition:
		7 of them and filesize < 245760
}