MALPEDIA_Win_Sobig_Auto

rule MALPEDIA_Win_Sobig_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e3b61d69-b3b3-5107-871c-ab9a56977e6b"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sobig"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.sobig_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "df29896bef76ef85128a23e0a2929cae7dc7c292e0c773e515891b8846b960c8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 5f 64890d00000000 c9 c21000 f605????????01 7507 800d????????01 }
		$sequence_1 = { 4f 75cf 8d4dcc c645fc01 e8???????? 6a01 5e }
		$sequence_2 = { eb7b 68???????? e8???????? 59 8b4d10 50 68???????? }
		$sequence_3 = { 8d4dc8 e8???????? 8b470c c745fc06000000 8b00 ff30 e8???????? }
		$sequence_4 = { e8???????? 8b4508 53 56 57 8d7104 }
		$sequence_5 = { 6683e100 0fb7c0 0bc8 bb???????? 890f 895ddc }
		$sequence_6 = { e8???????? 8d8e80000000 c645fc01 e8???????? bf???????? 57 }
		$sequence_7 = { 5b c9 c20800 56 8b742408 57 8bf9 }
		$sequence_8 = { 80fb7a 7ed5 5e 5b 5f c9 c3 }
		$sequence_9 = { 8bc6 c1f905 83e01f 8b0c8d20bc4100 8d04c0 8d0481 8b4dfc }

	condition:
		7 of them and filesize < 262144
}