MALPEDIA_Win_Allaple_Auto

rule MALPEDIA_Win_Allaple_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "91fc2d21-93c0-5b23-b300-8dd84dc8d05c"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.allaple"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.allaple_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "b918fde6ef67bece0885bc42625f46c423847135b719a0a370bb8da06eede5e8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8985c8faffff eb12 6a00 ff37 ff36 8d85eefcffff }
		$sequence_1 = { 0355ec 03954cffffff 8b45e4 33c2 8945e4 8b4dec 8b55f0 }
		$sequence_2 = { e8???????? ff75f8 e8???????? c745f000000000 ebb5 5b }
		$sequence_3 = { 8d856cfeffff 50 57 e8???????? 03f8 c70702000000 83c704 }
		$sequence_4 = { 8b75fc 83c306 8bcb 03ce 51 8d85c8feffff }
		$sequence_5 = { 50 ffb5dcfaffff ffb5e0faffff 6a03 6a00 ff75f4 e8???????? }
		$sequence_6 = { e8???????? e9???????? 8b95b4fdffff 8d8a8a010000 c785b8fdffff00000000 80790a30 7523 }
		$sequence_7 = { 57 e8???????? 03f8 c70718000000 83c714 c707ffffffff 83c704 }
		$sequence_8 = { 8d9411eecebdc1 8955f8 8b45f8 c1e016 8b4df8 c1e90a }
		$sequence_9 = { 8db5ecf8ffff 83c604 0fb74605 eb07 b8ffffffff eb00 5b }

	condition:
		7 of them and filesize < 253952
}