MALPEDIA_Win_Badcall_Auto

rule MALPEDIA_Win_Badcall_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d919ad14-bbba-559a-92aa-bbfb06827c77"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.badcall_auto.yar#L1-L252"
		license_url = "N/A"
		logic_hash = "64b0ed42591d6e6d81719bc1cc4ff48dfeedfd6e071c21515b2908d5a65a10a9"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83c108 8901 8b44240c 895104 8b542410 }
		$sequence_1 = { 83c408 8bce 6a17 6a01 57 53 e8???????? }
		$sequence_2 = { 89442408 c1e902 f3a5 8bca 50 83e103 8d442410 }
		$sequence_3 = { 6a01 8d542420 53 52 50 ff15???????? }
		$sequence_4 = { 894204 8b4108 894208 8b490c 894a0c 8d4c243c e8???????? }
		$sequence_5 = { eb05 1bc0 83d8ff 85c0 754b bf???????? }
		$sequence_6 = { ff15???????? 83f8ff 7421 8b4604 68ffffff7f 50 }
		$sequence_7 = { 89542412 6689542416 ff15???????? 8b4e04 6689442406 }
		$sequence_8 = { 8b84243c010000 52 8b94243c010000 50 52 e8???????? 85c0 }
		$sequence_9 = { 8bbc244c430000 3b7804 7c12 5f 5e }
		$sequence_10 = { 899024020000 8b94242c010000 898828020000 89902c020000 83c004 50 8d44240c }
		$sequence_11 = { 81c438430000 c21000 8b16 52 e8???????? 83c404 8bc7 }
		$sequence_12 = { 83fd03 7336 8b4c2410 85c9 0f844d070000 8bd1 }
		$sequence_13 = { 668b10 8d442400 8d4c2408 50 51 }
		$sequence_14 = { 56 57 8b7c241c 83ff01 741b }
		$sequence_15 = { 83fa12 750a c744241c07000000 eb07 83c2f2 8954241c }
		$sequence_16 = { e9???????? e8???????? 83c408 85c0 0f849dfcffff 8b8424a8000000 c7442428ae080000 }
		$sequence_17 = { 6a01 53 8915???????? 66ab ff15???????? 8b2d???????? 8d4c242c }
		$sequence_18 = { c1f905 8d04c0 8b0c8de0ad0110 8d44810c 50 ff15???????? c3 }
		$sequence_19 = { 8bd9 762f 8b6c2414 8bc7 2bc6 }
		$sequence_20 = { 8a4dff 8d3c85e0ad0110 8bc3 80c901 83e01f 884d0b }
		$sequence_21 = { 898424a0000000 ff15???????? 8d942498000000 6a10 52 }
		$sequence_22 = { 6a00 50 8d842424010000 50 51 }
		$sequence_23 = { ff12 e9???????? 8b442438 3bc3 8d8424a8000000 50 56 }

	condition:
		7 of them and filesize < 483328
}