MALPEDIA_Win_Doppelpaymer_Auto

rule MALPEDIA_Win_Doppelpaymer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "219488d4-89aa-507f-a3b9-5b58b16e6a8e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.doppelpaymer_auto.yar#L1-L189"
		license_url = "N/A"
		logic_hash = "b12aaf94eae6466211c01080c895d68148cfa709c5f21789fb77a33176168e83"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 8b08 e8???????? 3db6389096 }
		$sequence_1 = { 80790600 7523 80790264 751d 80790561 7517 80790361 }
		$sequence_2 = { 80790361 7511 80790474 750b }
		$sequence_3 = { baffffff7f 43 e8???????? 3bd8 }
		$sequence_4 = { 83ec28 6800002002 6a00 6a01 }
		$sequence_5 = { 8b842494000000 f30f7e07 660fd64210 8d4a18 ff7008 e8???????? }
		$sequence_6 = { 8d0c24 e8???????? 8bc7 83c414 5d 5b 5f }
		$sequence_7 = { e8???????? ff30 8d4c2420 e8???????? 84c0 751a 6a00 }
		$sequence_8 = { 0f8594000000 8b45d0 b9e8f49929 2b4dec 8b5034 8b75ec }
		$sequence_9 = { e8???????? 84c0 7516 8b4d10 }
		$sequence_10 = { 83f800 8945f4 894df0 8955ec 7528 }
		$sequence_11 = { 8945d0 e9???????? 55 89e5 }
		$sequence_12 = { 56 83ec4c 8b4508 31c9 ba04000000 bee3049a29 }
		$sequence_13 = { 8b5594 8b7590 8b7dec 81f7ddeaa1f4 01fe c1ee01 }
		$sequence_14 = { 8b1b 8945f0 8bf0 b856555555 }
		$sequence_15 = { 033487 8945b0 894dac 8975b4 8955c0 e9???????? 8a45ca }
		$sequence_16 = { 8b758c 29d6 8b7d88 01d7 89fb }
		$sequence_17 = { f6c301 7415 8b4df4 51 }
		$sequence_18 = { 8b4db0 11cf 893402 897c0204 }

	condition:
		7 of them and filesize < 7266304
}