WildNeutron_Sample_9

rule WildNeutron_Sample_9 {
   meta:
      description = "Wild Neutron APT Sample Rule"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
      date = "2015-07-10"
      modified = "2023-01-06"
      score = 60
      hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
      id = "dbfdbe8c-4a4a-5512-a03d-e9f80c853d48"
   strings:
      $s0 = "http://get.adobe.com/flashplayer/" wide  /* score: '30.00' */
      $s4 = " Player Installer/Uninstaller" fullword wide  /* score: '11.42' */
      $s5 = "Adobe Flash Plugin Updater" fullword wide  /* score: '11.00' */
      $s6 = "uSOFTWARE\\Adobe" fullword wide  /* score: '10.42' */
      $s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
      $s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
      $s13 = "%d -> %d" fullword wide /* score: '7.00' */
   condition:
      uint16(0) == 0x5a4d and filesize < 1477KB and all of them
}