MALPEDIA_Win_Ceeloader_Auto

rule MALPEDIA_Win_Ceeloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1d7ad03f-5aa9-5141-8e52-1a82b7d122e4"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ceeloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ceeloader_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "bad566af8c3d90e70d1988225922395e6938287b80a820f071028582a7a804e4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 89d6 81e635913d02 89b424ec030000 8bb424ec030000 c1e601 89b424e8030000 44039c24e8030000 }
		$sequence_1 = { 4c8d0562cd0a00 488d1563cd0a00 b901000000 e8???????? 488bd8 4885c0 7417 }
		$sequence_2 = { ff15???????? 898424f80a0000 66c78424f60a00000000 66c78424f40a00000000 48c78424e80a000000000000 4c8b8424e80a0000 668b9424f40a0000 }
		$sequence_3 = { c784249002000075380000 c784248c020000c5360000 c78424880200005a380000 c7842484020000ff6f0000 c7842480020000123e0000 c784247c02000043360000 c78424780200001f220000 }
		$sequence_4 = { 488945cf 488945d7 488d05cc660700 488945ff 488d05d1660700 4889450f 488d05d6660700 }
		$sequence_5 = { 8bc6 0bda 8bde 0bd3 3bce 33f5 0bc3 }
		$sequence_6 = { 41c1ea05 44899424f4040000 442b8c24f4040000 44898c24f0040000 448b8c24f0040000 4189c2 4181e2b1524402 }
		$sequence_7 = { 0fbe05???????? 83f06c 88c1 884c2445 0fbe05???????? 83f06f 88c1 }
		$sequence_8 = { 41c1e405 4489a42458040000 4403bc2458040000 4489bc2454040000 448bbc2454040000 4589dc 4181e45d386101 }
		$sequence_9 = { 44698424a0090000ab000000 448984249c090000 448b84249c090000 41c1e80c 4489842498090000 446b84249809000003 4489842494090000 }

	condition:
		7 of them and filesize < 2321408
}