MALPEDIA_Win_Bookcodesrat_Auto

rule MALPEDIA_Win_Bookcodesrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4898aabc-f745-5eeb-b868-8989a59790fe"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bookcodesrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.bookcodesrat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "6a54c3bffa90c7116007b02d093cebae2be27970e91c5ba26d7c33c2fea354c6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488dbb40080000 66f2af 48f7d1 48ffc9 750d b960ea0000 ff9360360000 }
		$sequence_1 = { 85c0 750d ff15???????? 418985a8010000 84db 7431 c744245002000000 }
		$sequence_2 = { 735e 4d85ed 488b5c2420 0f8432feffff 498bdd }
		$sequence_3 = { 41ffd7 8b5d10 8b7d00 4903dc 4903fc 488bf0 48833b00 }
		$sequence_4 = { 48897330 ebad 48ff4b48 33c0 eb0d 488b4328 }
		$sequence_5 = { ff15???????? 488d9508080000 488bcf 488983f8360000 ff15???????? 488d5598 488bcf }
		$sequence_6 = { ff15???????? 488bf0 4885c0 0f8493010000 488d1556320100 488bc8 ff15???????? }
		$sequence_7 = { 488d0de3780200 8905???????? 488d051ee40100 4889442458 e8???????? 488d0d09a00100 48891d???????? }
		$sequence_8 = { 4053 4881ecb0030000 48c7442420feffffff 488bd9 488d8c24f0010000 488d93f0350000 41b8b8010000 }
		$sequence_9 = { 498bd4 4c3b6310 720b b957000780 e8???????? cc 4863c8 }

	condition:
		7 of them and filesize < 544768
}