MALPEDIA_Win_Dusty_Hammock_Auto

rule MALPEDIA_Win_Dusty_Hammock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "97ea5be3-4101-5edc-852a-56fc7838f7b4"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dusty_hammock"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.dusty_hammock_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "1bee63322ab76f5fb0667f02592a8f7af8ac3ef35979026a6082ad2da61ddae5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c745b8e04d4600 c745bc02000000 c745c800000000 89d9 89fa 8945d0 8d45d0 }
		$sequence_1 = { f20f1086c0000000 f20f108ec8000000 83f803 8986ac000000 898628010000 f20f1186b0000000 f20f118eb8000000 }
		$sequence_2 = { ba28000000 68???????? e8???????? 83c404 eb40 b9???????? c786b805000003000000 }
		$sequence_3 = { e8???????? 8b18 832000 85db 0f840f010000 ff02 8d4b34 }
		$sequence_4 = { c745ac01000000 c745b800000000 c745b004000000 c745b400000000 c745f0ffffffff e8???????? 55 }
		$sequence_5 = { c786b805000002000000 8b411c 8b4920 6a58 68???????? 50 ff510c }
		$sequence_6 = { e8???????? 59 5f 3d01000080 0f85320e0000 8b8648010000 8bbe44010000 }
		$sequence_7 = { 8b4820 6a01 68???????? ff701c ff510c 83c40c 2401 }
		$sequence_8 = { c745f002000000 8b45d0 8975ac c745f002000000 b9???????? ba16000000 8945b0 }
		$sequence_9 = { 83ec28 83c50c 8d4d8c e8???????? 8d8d78ffffff e8???????? 837dd400 }

	condition:
		7 of them and filesize < 1051648
}