MALPEDIA_Win_Disttrack_Auto

rule MALPEDIA_Win_Disttrack_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "53169439-d446-5a46-8914-3e46d4af0e4c"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.disttrack_auto.yar#L1-L264"
		license_url = "N/A"
		logic_hash = "eb36e0cc772010320a144ee63e859b04cd9e770414447bbd7f53d733325bd26c"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 52 6a00 6a00 6848000700 }
		$sequence_1 = { 53 ff15???????? 5d 5b 8bc7 5f 5e }
		$sequence_2 = { 83c404 50 e8???????? 83c404 68???????? ff15???????? }
		$sequence_3 = { 68???????? ff15???????? 8d45dc 50 ff15???????? 8b4ddc }
		$sequence_4 = { e8???????? 6a07 e8???????? 59 c3 6a10 }
		$sequence_5 = { 6a64 68???????? ff15???????? 6a64 68???????? }
		$sequence_6 = { 8bf8 c745fc03000000 e8???????? c645fc02 8b7d94 }
		$sequence_7 = { 8bc1 c1f805 8bf1 83e61f 8d3c8540174200 }
		$sequence_8 = { 837d0800 7412 837d0c00 7e0c 837d1000 }
		$sequence_9 = { 488d4c2432 8945ca 0fb705???????? 33f6 }
		$sequence_10 = { 8d4c0c44 3bfb 741e 8b410c 0bc7 }
		$sequence_11 = { e8???????? 8bd8 85c0 7432 488bce e8???????? e8???????? }
		$sequence_12 = { 48638528050000 498b16 498b0f 4889442468 0fb68540050000 4c8d1d03340000 }
		$sequence_13 = { 0fbe89a06d4200 85c9 750d e8???????? }
		$sequence_14 = { 408a6c2427 40b701 403aef 7454 }
		$sequence_15 = { 8bff 56 57 33ff ffb740004200 ff15???????? 898740004200 }
		$sequence_16 = { 7406 53 e8???????? 8d44244c e8???????? }
		$sequence_17 = { ff15???????? 33d2 75fc eba1 33c0 }
		$sequence_18 = { eb01 53 e8???????? 8b8c24ec500000 5f 5e }
		$sequence_19 = { 50 e8???????? 6a00 6800020000 52 }
		$sequence_20 = { 8b55ec 8b4254 50 e8???????? 83c408 85c0 }
		$sequence_21 = { 4a8d4c5c30 e8???????? 488bcf e8???????? 488d4c2430 8d5c0002 e8???????? }
		$sequence_22 = { 8d1480 3bd6 7e08 c7442410ffffffff ff442410 e9???????? 83f903 }
		$sequence_23 = { 8b442460 488b4c2458 8907 ff15???????? }
		$sequence_24 = { 1bc0 23d8 6644396de0 752a 66397de2 7524 66443965e6 }
		$sequence_25 = { 33f6 8d85e8feffff 898578ffffff 8d7d94 8d8540ffffff }
		$sequence_26 = { 57 4883ec20 488b7968 488d0546490100 8bf2 488bd9 }

	condition:
		7 of them and filesize < 1112064
}