MALPEDIA_Win_Systembc_Auto

rule MALPEDIA_Win_Systembc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "be08117d-8246-530f-9d5f-cd6143f1e35f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.systembc_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "a9818f1f55e16b84edae3af4f5f9f1c3955cbf2e948518d2fcc753adba968256"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { b000 ae 75fd 8a57fe 80fa39 }
		$sequence_1 = { e8???????? 8b450c 8945e4 c745e801000000 c745ec06000000 8d45dc }
		$sequence_2 = { 53 57 56 8b7d10 33c0 ab }
		$sequence_3 = { ff7518 6a00 6a00 ff75fc e8???????? 6a00 }
		$sequence_4 = { 803f00 740b 837d1000 7407 }
		$sequence_5 = { 7403 ff47fc 8b4508 ab 8b450c }
		$sequence_6 = { 8b45f8 8b08 8b91a8000000 50 ffd2 8d85f4fbffff }
		$sequence_7 = { 6a10 68???????? e8???????? 8d85bcfbffff }
		$sequence_8 = { 66837aff00 7502 eb2e 837d0cff }
		$sequence_9 = { 89848dbcfbffff 482d04040404 48ffc9 75ee 4833c0 488b7d10 4833db }
		$sequence_10 = { ff15???????? 4883c420 e9???????? 66c78560ffffff0200 807e0703 7553 480fb65e08 }
		$sequence_11 = { e8???????? 4883c420 4883ec20 488d8e90010000 488d55a0 }
		$sequence_12 = { 488b7520 488b7d10 488b4d28 4833db }
		$sequence_13 = { 4883ec20 488b4d98 488d9560ffffff 49c7c010000000 ff15???????? 4883c420 }
		$sequence_14 = { c68575ffffff00 c68576ffffff01 48c78510ffffff01000000 4883ec20 488b4d98 }
		$sequence_15 = { 83f900 7fe4 4883bdb8fbffff01 0f84cf000000 48b8fcfdfeff00000000 48c7c140000000 89848dbcfbffff }

	condition:
		7 of them and filesize < 75776
}