MALPEDIA_Win_Soul_Auto

rule MALPEDIA_Win_Soul_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9dd6236-3340-50b4-b5d0-39eff17887cc"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soul"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.soul_auto.yar#L1-L235"
		license_url = "N/A"
		logic_hash = "006ca2db66b727a223c7e1c69f1643e1ec1c7be66a86b7b95f1d15a0130986f8"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { d3e2 8515???????? 7405 e8???????? }
		$sequence_1 = { 40 803800 75f8 c745fc00000000 90 56 ff15???????? }
		$sequence_2 = { 57 8bf8 be???????? 743a 8da42400000000 }
		$sequence_3 = { ff25???????? 48895c2408 4889742410 57 4883ec30 }
		$sequence_4 = { 7cde c745fc00000000 8da42400000000 8b4df8 51 57 }
		$sequence_5 = { 741f 8da42400000000 8b03 57 50 }
		$sequence_6 = { 85f6 0f84a4000000 803f00 8bc7 }
		$sequence_7 = { 85f6 7506 837dfc04 7cda }
		$sequence_8 = { 7409 90 fe08 40 803800 }
		$sequence_9 = { 83c404 33f6 897304 8b4304 }
		$sequence_10 = { eb22 e8???????? 488b4c2420 ffd0 90 48837c245008 }
		$sequence_11 = { c744243a66003600 66448974243e 488d1d4ad10100 488bc3 488d7c2448 482bfb 0fb710 }
		$sequence_12 = { ffc7 4883c202 413bf8 72db 8bce 85f6 743c }
		$sequence_13 = { 7507 c743089a020000 85c0 0f84be010000 83f802 0f84b5010000 83f801 }
		$sequence_14 = { 741a 488d05f9ef0000 483bf8 740e 833f00 }
		$sequence_15 = { 4c8bf1 b801000000 85ff 7404 8932 eb06 8bf8 }
		$sequence_16 = { c745c047006c00 c745c662006100 c745ca6c005c00 668945ec c745ce43006100 c745d468006500 }
		$sequence_17 = { 442bda 4183fb0f 731e 0fb606 418bcb 4883c602 }
		$sequence_18 = { e8???????? 41894620 458bef 418bff 41c74608373f0000 eb05 }
		$sequence_19 = { 488b4593 89442448 8bc8 e8???????? 488bf0 33c0 8945c7 }
		$sequence_20 = { 4883eb02 4983c9ff ebae 488d45ef 4c8b4507 4983f808 490f43c4 }
		$sequence_21 = { eb2e 4c8b542418 33ed 0f1f840000000000 420fb60411 48ffc1 }
		$sequence_22 = { 488d1dc7850000 488d3de0850000 eb0e 488b03 4885c0 7402 }

	condition:
		7 of them and filesize < 1400832
}