MALPEDIA_Win_Nspx30_Auto

rule MALPEDIA_Win_Nspx30_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b22e3e59-f319-5673-9dc0-96165ddd7704"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nspx30"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.nspx30_auto.yar#L1-L301"
		license_url = "N/A"
		logic_hash = "fed61bebbef5d40ec95332a201d1065f73e26341d152ec810e6c95101dc32cfd"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f3ab 66ab aa b06c }
		$sequence_1 = { 8b00 3bd0 7416 83c018 7411 ff750c }
		$sequence_2 = { 8d84241c010000 68ff000000 50 53 ff15???????? 8d8c241c010000 51 }
		$sequence_3 = { 7577 8b35???????? 8d94241c010000 68???????? 52 ffd6 }
		$sequence_4 = { 2bc1 3bd0 746e 668932 83c202 3bd0 75f6 }
		$sequence_5 = { 56 57 33db b97f000000 33c0 8dbc241e010000 }
		$sequence_6 = { eb1a 81f977665500 7504 8918 eb10 81f988776600 }
		$sequence_7 = { 8dbc241e010000 66899c241c010000 f3ab 8d84241c010000 68ff000000 }
		$sequence_8 = { 75f9 2bce 51 52 eb57 }
		$sequence_9 = { 57 8bca bf???????? 33db }
		$sequence_10 = { 56 57 68ff1f0000 8d85d9deffff }
		$sequence_11 = { 80a0c065001000 40 3bc6 72be 5e c9 }
		$sequence_12 = { 683d270000 ff15???????? 83c8ff 5e c21400 6879270000 ff15???????? }
		$sequence_13 = { 50 ffd6 53 ff15???????? 50 e8???????? 83c404 }
		$sequence_14 = { c784246001000004000000 ff15???????? 85c0 0f8c89010000 8b4c2410 }
		$sequence_15 = { c20400 8d85d8fdffff 50 53 57 }
		$sequence_16 = { e8???????? 68???????? e8???????? 83c404 c745fcffffffff 8d4508 }
		$sequence_17 = { c64424336c c644243400 ffd7 83c408 }
		$sequence_18 = { 5b 754a c7002c000000 895004 895008 }
		$sequence_19 = { 894dec 837dec0e 7d13 8b55ec 837c959800 7507 }
		$sequence_20 = { ba44000000 6a00 6689542478 66899424a2000000 66899424b0000000 66899424b2000000 8d54246c }
		$sequence_21 = { 85c0 7417 8d7d9c 4f 8bff 8a4701 }
		$sequence_22 = { aa 8d442404 50 51 e8???????? 83c408 85c0 }
		$sequence_23 = { 0f86eb000000 8b30 8b6c2420 03f3 }
		$sequence_24 = { 83e203 83f908 7229 f3a5 ff249518310010 8bc7 }
		$sequence_25 = { 6a08 ff15???????? 6a40 6800300000 }
		$sequence_26 = { 8a10 8816 46 eb0f 0fb6d2 f682c166001004 }
		$sequence_27 = { b86e000000 b969000000 66898424c4000000 66898424d0000000 66898424e4000000 }
		$sequence_28 = { 8bf0 85db 742e 85ff 742a }
		$sequence_29 = { 035128 8955f8 837df800 7502 eb38 6a00 }
		$sequence_30 = { 8b4d08 034878 894dfc 8b55fc 8b4508 034220 8945ec }

	condition:
		7 of them and filesize < 3789824
}