MALPEDIA_Win_Dmsniff_Auto

rule MALPEDIA_Win_Dmsniff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4010e97f-48bb-5278-898a-0ed97c9f7b8c"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dmsniff"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.dmsniff_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "f04de7d9182e8a36c29c1a839d5e0508e3e0fa7a86c5eb0919822ac74023875e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb15 47 39f7 72d3 ff45fc 8b45f4 3945fc }
		$sequence_1 = { 09ff 7413 81fe19000200 7507 be19010200 ebd9 31c0 }
		$sequence_2 = { 8b7510 ff7508 e8???????? 89c7 }
		$sequence_3 = { 57 be19000200 8d45fc 50 56 }
		$sequence_4 = { 8945f0 50 e8???????? 89c3 81e3ff000000 89de 83c661 }
		$sequence_5 = { 57 e8???????? 59 be0f000000 }
		$sequence_6 = { 83bdfcfeffff40 7316 8bbdfcfeffff 89fe 46 89b5fcfeffff }
		$sequence_7 = { 8945f4 50 e8???????? 89c3 }
		$sequence_8 = { 761a 68???????? e8???????? 50 }
		$sequence_9 = { 66810c240003 d92c24 83c404 6a00 }

	condition:
		7 of them and filesize < 131072
}