MALPEDIA_Win_Beepservice_Auto

rule MALPEDIA_Win_Beepservice_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d0b2d35c-7151-5641-b116-a0b3724c7616"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beepservice"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.beepservice_auto.yar#L1-L269"
		license_url = "N/A"
		logic_hash = "96eed46803cdcdaba4a22cade7e8e847250bcc2e47b4a1e919f61f3d3c0a4034"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b0d???????? 68???????? ffd6 8bc8 ff15???????? 50 ff15???????? }
		$sequence_1 = { e8???????? 83f801 7505 e8???????? 68???????? 68???????? }
		$sequence_2 = { 7512 6888130000 68???????? e8???????? }
		$sequence_3 = { 83c408 e9???????? 68???????? e8???????? 83c404 6a00 6a00 }
		$sequence_4 = { 7516 ff15???????? 50 68???????? e8???????? 83c408 eb0d }
		$sequence_5 = { 683f000f00 6a00 68???????? ff15???????? }
		$sequence_6 = { 55 56 ff15???????? 85c0 7513 ff15???????? 50 }
		$sequence_7 = { 57 53 e8???????? 6a20 57 bf???????? 57 }
		$sequence_8 = { 55 e8???????? 6a28 bb???????? 57 }
		$sequence_9 = { 57 ff760c ff15???????? 33ff }
		$sequence_10 = { ff7610 53 e8???????? ff7614 e8???????? }
		$sequence_11 = { 50 68???????? eb43 56 8d45fc }
		$sequence_12 = { ff7618 68???????? e8???????? 59 59 ff761c e8???????? }
		$sequence_13 = { 8b5318 8bfa f2ae f7d1 49 }
		$sequence_14 = { 8bd0 33c0 a3???????? b90a000000 a3???????? bf???????? }
		$sequence_15 = { ff15???????? 85c0 742b 817c240400240000 7521 }
		$sequence_16 = { 8b4d0c 8b5104 52 68???????? e8???????? 83c408 eb0a }
		$sequence_17 = { b801000000 e9???????? 8b4d0c 8b5114 }
		$sequence_18 = { e8???????? 83c404 83f820 7314 8b450c 8b481c 51 }
		$sequence_19 = { ff15???????? 85c0 a3???????? 7510 ff15???????? 50 e8???????? }
		$sequence_20 = { c3 6888130000 6a03 6a00 6a00 }
		$sequence_21 = { 6a03 e8???????? 83c414 e9???????? a1???????? 85c0 }
		$sequence_22 = { 668b0d???????? 51 ff15???????? 668bf0 }
		$sequence_23 = { eb08 c744240c2a040000 8b54242c 8d4c2400 89542414 8b15???????? }
		$sequence_24 = { 6a00 56 57 ff15???????? 8b45e4 85c0 }
		$sequence_25 = { 89442414 8b442434 51 52 }
		$sequence_26 = { c744240010000000 89442404 83e802 f7d8 1bc0 83e007 89442408 }

	condition:
		7 of them and filesize < 253952
}