diff --git a/yara/malware.yar b/yara/malware.yar
index cf434db..3da40a2 100644
--- a/yara/malware.yar
+++ b/yara/malware.yar
@@ -11703,5 +11703,5 @@ rule MALWARE_Win_Houdini {
          $pl2 = "plugin_url_init" fullword wide
          $pl3 = "plugin_stop" fullword wide
      condition:
-         uint16(0) == 0x5a4d and 8 of them
+         uint16(0) == 0x5a4d and 4 of them
 }