WaterBug_wipbot_2013_core_PDF

rule WaterBug_wipbot_2013_core_PDF {
	meta:
		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
	strings:
		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
	condition:
		uint32(0) == 0x46445025 and #a > 150 and #b > 200
}