MALPEDIA_Win_Vohuk_Auto

rule MALPEDIA_Win_Vohuk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fb6b58d3-fa4a-5eee-bc81-fe16f3c6b51f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vohuk"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.vohuk_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f4b261500b0d3d44477009b29f1d4f668d5ebc735b2f6389f2d738c0d8340208"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83fe44 72d3 57 e8???????? 83c404 8b0d???????? ba14102140 }
		$sequence_1 = { 8b4508 53 56 57 5f 5e c7004d005d00 }
		$sequence_2 = { c7842402010000b100b600 c7842406010000b400fb00 c784240a010000f100e300 c784240e010000fe009900 c784241201000089008d00 c78424160100008700c300 c784241a010000a1008b00 }
		$sequence_3 = { 6a4d e8???????? 8d4db8 51 56 ffd0 8bf8 }
		$sequence_4 = { b8e7000000 c745f2bd00b400 56 c745f68c008c00 33f6 c745fa90008d00 668945fe }
		$sequence_5 = { c740747f013d01 c7407810011401 c7407c4f014c01 c7808000000044014301 c7808400000050014101 c7808800000005014001 c7808c0000004e014601 }
		$sequence_6 = { c5fd708560ffffff4e c5fe7f65c0 c5fdfee4 c5d5ef85e0fdffff c5fe7fa5c0fdffff c5ddefe1 c5f572f00c }
		$sequence_7 = { 6a20 ff75cc ff9520ffffff 85c0 0f8529010000 8b0d???????? ba43c7bfd0 }
		$sequence_8 = { 6a00 6aff ffd0 8b0d???????? ba25000044 688c000000 a3???????? }
		$sequence_9 = { 8bf2 8b5508 b908000000 57 8d7ddc f3a5 8a45fb }

	condition:
		7 of them and filesize < 260096
}