MALPEDIA_Win_Donex_Auto

rule MALPEDIA_Win_Donex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "448d8eab-91d5-581e-9128-b8e92cc4c6d6"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.donex"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.donex_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "fd7a45034170c213dbf47788e8cec6ac0515ae637ff587ea25a68270120c3322"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6bd830 8b04bd08a44300 f644032801 7444 837c0318ff 743d e8???????? }
		$sequence_1 = { e8???????? 8bf0 83c408 85f6 0f8588010000 837df001 7203 }
		$sequence_2 = { 7551 50 8d45b8 50 6a40 50 e8???????? }
		$sequence_3 = { 8b5de8 c1c009 8bcb 03c6 f7d1 234de0 81c69979825a }
		$sequence_4 = { 894dc4 33c6 c1c105 05d6c162ca c1ce02 0345c0 81c7d6c162ca }
		$sequence_5 = { 0345c8 03c8 8b45fc 3345f4 3345f0 0345b4 0145f8 }
		$sequence_6 = { 75ef 8d48fe 668b4102 8d4902 6685c0 75f4 a1???????? }
		$sequence_7 = { 8b85f0fcffff 8d8df0fcffff 8945c0 8b85f4fcffff c745f440000000 8945e0 }
		$sequence_8 = { 0bd3 8b5dfc 2355dc 03df 0bca 895de0 }
		$sequence_9 = { c1e908 0fb6c9 0fb689487c4300 314d10 8b4d10 334dec 330d???????? }

	condition:
		7 of them and filesize < 505856
}