MALPEDIA_Win_Burnbook_Auto

rule MALPEDIA_Win_Burnbook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "02000a13-2529-57ea-aa62-b6f7ce3e2eb2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.burnbook"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.burnbook_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6367011145daa4e6e20d8dc7e17d53718b953c9e018db0f0c6352f7209d0790a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ff432c e9???????? 44396b30 7432 8b4b34 8d41db 83f838 }
		$sequence_1 = { f7d8 894614 8b461c f7d8 89461c 0fb67b6a e8???????? }
		$sequence_2 = { ffc8 894afc 85c0 7fec 0fb64500 41ffc2 49ffc3 }
		$sequence_3 = { f30f1007 f30f104f04 488b4b28 f30f59c6 f30f59ce f30f2cc0 f30f104708 }
		$sequence_4 = { f30f585110 f30f10491c 0f28df f30f584914 f30f585120 f30f584924 f30f585128 }
		$sequence_5 = { f20f594240 f20f5cf2 f2440f5cc0 0f28c7 f20f5902 0f28ce f20f594a10 }
		$sequence_6 = { f7d9 4585db 410f44cc 41c1e313 4183cb10 41894d00 41834ffc20 }
		$sequence_7 = { f20f59ca f20f580d???????? 660f2fc1 720a 33c0 66c1c008 668901 }
		$sequence_8 = { f00fc14108 83f801 7505 e8???????? 488b4d30 48897530 4885c9 }
		$sequence_9 = { f7d9 81e1ff7f0000 894b68 488b4378 488bc8 ff10 8b4b6c }

	condition:
		7 of them and filesize < 22976512
}