MALPEDIA_Win_Defray_Auto

rule MALPEDIA_Win_Defray_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "91dbb208-60a5-5e96-a645-56c436179440"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.defray"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.defray_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "6b4e097237ff798ba5626d5bee417027ad739d6a04da88a35accdf2c8cd93643"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8d34ba 3bf0 741b 8bf8 2bf8 57 50 }
		$sequence_1 = { 8b4dec ba10000000 8b7df0 8d49ff d3e2 8bcb }
		$sequence_2 = { 8bf0 894dfc 2bf2 8d7b1f c1ef05 c1fe02 897d08 }
		$sequence_3 = { 85c0 7471 8b45f0 8b4de8 8b048568f34800 f644012880 745d }
		$sequence_4 = { 8bc2 8bca 83e03f c1f906 6bc030 03048d68f34800 eb05 }
		$sequence_5 = { ab ab ab 66ab 33c0 8dbd74faffff a5 }
		$sequence_6 = { 740b 50 ff15???????? 32c0 eb31 e8???????? 3bf0 }
		$sequence_7 = { 84c0 750f 8d8d98fbffff e8???????? 84c0 7430 8d8d68f9ffff }
		$sequence_8 = { c1ee02 8bfb 8bce 33c0 f3ab 8b75e8 33d2 }
		$sequence_9 = { eb07 c6437600 894304 8b8544ffffff 85c0 0f8482000000 }

	condition:
		7 of them and filesize < 1253376
}