MALPEDIA_Win_Cuba_Auto

rule MALPEDIA_Win_Cuba_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a35b9290-3766-538c-a78b-83e4f421f750"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuba"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.cuba_auto.yar#L1-L166"
		license_url = "N/A"
		logic_hash = "0adb50371f856938be045a74c4609808fc9f721ab8545ed3a45e4ef714da22cc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0019 43 41 00444341 }
		$sequence_1 = { 6a00 6a02 8985c0fbffff ff15???????? 8d8dccfbffff 8985c8fbffff 51 }
		$sequence_2 = { 003a 45 41 004245 }
		$sequence_3 = { 000d???????? 384100 b538 41 }
		$sequence_4 = { 000c43 41 0035???????? 43 }
		$sequence_5 = { 000446 41 00d1 45 }
		$sequence_6 = { ff15???????? 33c0 8bf8 8985f8f7ffff 8bb778df4100 8d95fcf7ffff }
		$sequence_7 = { 0012 45 41 0026 }
		$sequence_8 = { 3b0cc5905d4100 7427 40 83f82d 72f1 8d41ed }
		$sequence_9 = { 3d00002000 7710 8d85e8f7ffff 8bcf 50 e8???????? eb55 }
		$sequence_10 = { 0026 45 41 003a }
		$sequence_11 = { 0026 43 41 00b043410062 }
		$sequence_12 = { 5d c3 8b04c5945d4100 5d c3 }
		$sequence_13 = { ffb5e8f7ffff ff15???????? 8b8de4f7ffff 8b85e0f7ffff 3bcb 7f4c 7c07 }
		$sequence_14 = { 33c0 c785c0f9ffff2c020000 668985ecfbffff 668985f4fdffff 8d85c0f9ffff 50 56 }
		$sequence_15 = { ffb5fcfdffff ff15???????? 85c0 750d 8b95c0fbffff 53 e8???????? }

	condition:
		7 of them and filesize < 1094656
}