MALPEDIA_Win_Cadelspy_Auto

rule MALPEDIA_Win_Cadelspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "09d1758f-a520-5c0d-81b5-c2deb27a970c"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.cadelspy_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "fce9390a5d669b33d92b5af3d935821f8b211b393683ce55eed8363c1b662d0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 03c7 66890c43 47 eb08 85ff 7e02 }
		$sequence_1 = { ff750c be04010000 8bce e8???????? 8b550c 59 }
		$sequence_2 = { 2b34bd004c0110 c1fe06 8bc7 c1e005 03f0 8975e4 837de4ff }
		$sequence_3 = { 8d9c2464020000 e8???????? 68???????? 8d9c2464020000 e8???????? }
		$sequence_4 = { ff15???????? 50 ff15???????? c9 c3 a1???????? }
		$sequence_5 = { 83658000 8d4584 53 50 e8???????? 0fbe4584 }
		$sequence_6 = { 68???????? eb44 837d8c06 7543 68???????? eb37 8d856c030000 }
		$sequence_7 = { 8bcf 8d950cf9ffff e8???????? 33c0 }
		$sequence_8 = { bf04010000 57 8d8504f7ffff 50 53 }
		$sequence_9 = { 8d7902 668b31 41 41 6685f6 }

	condition:
		7 of them and filesize < 204800
}