MALPEDIA_Win_Anchor_Auto

rule MALPEDIA_Win_Anchor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6d13839a-1ec1-504f-9a24-f75e63119b5e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.anchor_auto.yar#L1-L211"
		license_url = "N/A"
		logic_hash = "5bbbe06646a03dc8328467a298828d31e85ca378152e4d97a6baf9d0107bf3bd"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 66c740016578 c6400365 eb0a 66c74001646c }
		$sequence_1 = { e8???????? 660f6ec0 f30fe6c0 f20f5e05???????? f20f5905???????? e8???????? }
		$sequence_2 = { 33c9 8bf8 f7e6 0f90c1 f7d9 0bc8 51 }
		$sequence_3 = { 33c9 8b4608 6689581a 8b4608 5b 6689481c }
		$sequence_4 = { 66894830 33c9 8b4610 66894832 }
		$sequence_5 = { f2e965020000 e9???????? 53 56 57 6a00 68a00f0000 }
		$sequence_6 = { 56 e8???????? 8b30 833e00 }
		$sequence_7 = { b101 e8???????? e8???????? 84c0 }
		$sequence_8 = { 66894304 33c0 6a01 894306 }
		$sequence_9 = { 0bc1 488b4d48 8801 488b4548 }
		$sequence_10 = { 4c89742420 4c8d4dbb 4533c0 488b4d2f ff15???????? 8b4db7 }
		$sequence_11 = { 00040f 830905 0000 83bd641a0000ff }
		$sequence_12 = { 85c0 0f8401010000 488d05bffd0000 4a8b04e8 42f644303880 }
		$sequence_13 = { 488b4338 6689480c 8d4f53 488b4338 6689480e }
		$sequence_14 = { 03c2 c1f802 6bc003 894504 }
		$sequence_15 = { 0bc1 4898 488d0d12920200 488b5528 }
		$sequence_16 = { 66894810 8d4f7a 488b4320 6644894812 }
		$sequence_17 = { 03c8 8bc1 8985a4000000 488d8da8010000 }
		$sequence_18 = { e8???????? 90 488d0d06f50000 e9???????? }
		$sequence_19 = { 4903c9 488b4360 418d5012 66891448 488b4360 66897c4802 }
		$sequence_20 = { 05e0930400 894544 8b5544 488b4508 }
		$sequence_21 = { 0000 83bd641a0000ff 0f85fc040000 c6859412000000 }
		$sequence_22 = { 034524 3b8520010000 760c c785f400000001000000 }

	condition:
		7 of them and filesize < 778240
}