Signed azo yara

rule Sign_azo
{
    meta:
        description = "Signed azorult"
        author = "James_inthe_box"
        reference = "796e6d59f5cbc3eba40c08c9a4c1002677bbf2be75a7dc3fd779a7f133a49e83"
        date = "2019/01"
        maltype = "Infotealer"

    strings:
        $mz = { 4d 5a }
        $string1 = "GoogleUpdate.exe" wide
        $string2 = "Google Inc." wide
        $string3 = "1.3.29.1" wide
        $string4 = "041904e3" wide
        $string5 = "info@singh-content.co.uk"
        $string6 = "London1806"
        $string7 = "Singh Agile Content Design Limited"

    condition:
        ($mz at 0) and (all of ($string*)) and filesize < 1400KB
}