APT_Malware_PutterPanda_Gen1

rule APT_Malware_PutterPanda_Gen1 {
	meta:
		description = "Detects a malware "
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2015-06-03"
		super_rule = 1
		hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
		hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
		hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
		id = "5e7910e7-3f33-50fb-a87f-bf0bbf8a2797"
	strings:
		$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.02' */
		$s2 = "ssdpsvc.dll" fullword ascii /* score: '11.00' */
		$s3 = "Fail %s " fullword ascii /* score: '10.04' */
		$s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii /* score: '10.01' */
		$s5 = "LsaServiceInit" fullword ascii /* score: '7.03' */
		$s6 = "%-8d Fs %-12s Bs " fullword ascii /* score: '5.04' */
		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5.00' */ /* Goodware String - occured 5 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
}