MALPEDIA_Win_Buer_Auto

rule MALPEDIA_Win_Buer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1e1a5820-8fa5-59b2-b595-8d73a32e8028"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.buer_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "921395bce477c1b9ecd1dcd4c857b8de2c037c952a81b027cd27325054ab3709"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b5348 8b734c 8b7b50 8b4340 0345f8 }
		$sequence_1 = { 894154 5b c9 c3 }
		$sequence_2 = { 7e13 3bc7 7d0f 8a0c46 880c18 40 3bc2 }
		$sequence_3 = { 6a04 50 8945f8 ff15???????? }
		$sequence_4 = { 5f 5e 894154 5b }
		$sequence_5 = { 8b45f0 03c2 8b55e8 015158 8b55d8 }
		$sequence_6 = { 894148 8b45dc 03c6 89414c 8b45fc 03c7 894150 }
		$sequence_7 = { 33c0 85d2 7e13 3bc7 }
		$sequence_8 = { 0fb613 8d7b01 49 897d00 894c2408 894d04 897c2404 }
		$sequence_9 = { 01cf 0f92c1 08f9 751d 89c6 0fb6cb 45 }
		$sequence_10 = { 0fa4c208 c1e008 09c1 89c8 }
		$sequence_11 = { 01fe 68???????? e8???????? a1???????? }
		$sequence_12 = { 0f84d7010000 8b442418 8b5c2404 8b54242c }
		$sequence_13 = { 0facd108 c1ea08 eb14 8b0e 01e9 57 53 }
		$sequence_14 = { 01c7 0fa5da d3e3 8b4c2444 89f8 895c241c }
		$sequence_15 = { 01de 39c1 0f47c1 89c1 }

	condition:
		7 of them and filesize < 3031040
}