MALPEDIA_Win_Daserf_Auto

rule MALPEDIA_Win_Daserf_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc942ddd-6198-516b-83c8-dcf3dfacd02a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.daserf_auto.yar#L1-L157"
		license_url = "N/A"
		logic_hash = "d31e1e550b99f39b2cfdd4c3b670f9eaf5ebe958d543de563b1581bc33fb9241"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 2d7458acf0 81eb4087a1c9 81c324977364 2df0c5683d }
		$sequence_1 = { 2d3d9dddda 2d122b9e6e 05a176df80 056a8ceb26 81c3091794b7 81c3477483eb }
		$sequence_2 = { f7d2 055764eba6 96 89b42430f4ffff 8bf0 8b842430f4ffff }
		$sequence_3 = { ff75e0 8d1b ff75fc 90 }
		$sequence_4 = { 0593f8abb9 90 0536f1718f 9b }
		$sequence_5 = { 92 89942410f1ffff 8bd0 8b842410f1ffff }
		$sequence_6 = { 81eb477bafc6 90 81eb1979d9a8 8bdb 05f1ad59f9 }
		$sequence_7 = { 8bc0 8b842400f3ffff 81ebee7d857e 7500 2d444a28fe }
		$sequence_8 = { 97 89bc2400f1ffff 8bf8 8b842400f1ffff }
		$sequence_9 = { 81c3cfcdd8a3 81eb4769227d 05635637f9 05b537d85e 2dd80e91af }
		$sequence_10 = { 05ddf775a4 0583ee701f 2de339226e 81c368780090 81c3f215efea 81eb33a8c4a5 }
		$sequence_11 = { 8b842420f4ffff 53 8bdb 53 }
		$sequence_12 = { 056213cf4c 2d025bcd54 81eb4f4edeb1 055b9204af 05be0a5f12 058a52e815 }
		$sequence_13 = { 81eb8f465a28 05d4ec048f 05ace3258a 2d8c7110f6 }
		$sequence_14 = { 2dd1ab761c 81eb0752c899 81eb5e2deea0 056e62ed8e }
		$sequence_15 = { 2d99ba6fa8 2d7df1f9f5 81c32b692a0c 81eb4ce843f8 }

	condition:
		7 of them and filesize < 245760
}