MALPEDIA_Win_Dadjoke_Auto

rule MALPEDIA_Win_Dadjoke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e70c26e7-ab23-539f-9446-f64c119c6dd4"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadjoke"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.dadjoke_auto.yar#L1-L231"
		license_url = "N/A"
		logic_hash = "52eb13df90c67913476e398c58754b4e8e0394f30601d8e379450da51f4622c9"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 56 57 6800081000 6a00 }
		$sequence_1 = { 894808 8b95ecfeffff 89500c 8b8df0feffff 894810 c745e814000000 }
		$sequence_2 = { 83c201 8955cc 8b45f8 8a08 }
		$sequence_3 = { b941000000 f3a5 8b4dfc 81c104010000 894dfc 8b5508 }
		$sequence_4 = { 8b55ac 895584 894d80 a1???????? 83c0ff 8945c8 }
		$sequence_5 = { e8???????? 8945e8 837de8ff 7533 c645f300 }
		$sequence_6 = { 8b0d???????? 51 e8???????? 83c414 eb1e }
		$sequence_7 = { 6a00 ff15???????? e9???????? 8b4dd4 51 ff15???????? 8be5 }
		$sequence_8 = { 33c9 84c0 0f94c1 8bc1 c3 a1???????? }
		$sequence_9 = { 6a02 ff15???????? 85c0 7417 }
		$sequence_10 = { 5e c3 8bff 55 8bec 83ec10 33c0 }
		$sequence_11 = { e8???????? c3 6a04 e8???????? 59 c3 6a0c }
		$sequence_12 = { 50 e8???????? 83c404 bf3e000000 }
		$sequence_13 = { e8???????? 5e 5d c3 e8???????? 85c0 0f84d5480000 }
		$sequence_14 = { 8d85f8feffff 68???????? 50 e8???????? 6804010000 }
		$sequence_15 = { 85c0 0f85b5000000 50 ff15???????? 8d85e4faffff 50 68???????? }
		$sequence_16 = { 741d 8d4588 50 6800100000 8d041e 50 }
		$sequence_17 = { ff5108 8b3d???????? 8b1d???????? 51 e8???????? }
		$sequence_18 = { 740d 803e4d 7508 807e015a }
		$sequence_19 = { 6800400000 6800004000 56 ffd7 }
		$sequence_20 = { 0f8241ffffff 68???????? e8???????? 8b75fc 83c404 }
		$sequence_21 = { 00f8 e401 00ec e401 00dc e401 00ca }
		$sequence_22 = { 33f6 8b45e4 83f810 720d 40 8d4dd0 50 }

	condition:
		7 of them and filesize < 344064
}