MALPEDIA_Win_Elise_Auto

rule MALPEDIA_Win_Elise_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9450a6f-39e8-5559-8ea2-38a29ab7f193"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elise"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.elise_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "5ded95c4439812b9f226de5926faad139bbac5d5faba8fe45353b300b601040b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 85c0 0f8484000000 53 57 }
		$sequence_1 = { 8b01 294104 8b5104 8bf2 c1ee1f f7de }
		$sequence_2 = { 8901 8b4108 8b5008 56 8b30 }
		$sequence_3 = { 5f c3 56 be4d5a0000 663931 7534 }
		$sequence_4 = { 034e0c 0111 8b7dfc 47 3b7df8 897dfc 7cc6 }
		$sequence_5 = { 7cf5 33c9 888f00010000 888f01010000 8bf7 }
		$sequence_6 = { c1e006 8d5828 c745f406000000 8d0433 8d0447 }
		$sequence_7 = { 66894202 57 8bc3 c1e310 }
		$sequence_8 = { 8b481c 8b5814 03ca 33d2 42 2b5010 7816 }
		$sequence_9 = { d1e8 33c2 eb02 d1e8 4e 75f1 }
		$sequence_10 = { 8b7df4 8d4e01 81e1ff000080 7908 49 81c900ffffff }
		$sequence_11 = { 46 4f 75eb f7d0 }
		$sequence_12 = { 8a8800010000 8a9001010000 0f8e93000000 53 }
		$sequence_13 = { 83c8ff b9ff000000 83ff08 0f82a1000000 8bd7 }
		$sequence_14 = { 0145f0 6a00 6800010000 ff75ec 1155f4 }
		$sequence_15 = { 0fb6d2 03d7 81e2ff000080 7908 4a 81ca00ffffff 42 }

	condition:
		7 of them and filesize < 204800
}