MALPEDIA_Win_Faketc_Auto

rule MALPEDIA_Win_Faketc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8c126587-3e07-5c7a-9023-e24f5c209fe2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.faketc"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.faketc_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f7a97adeb3040f37295c7f4761ab9ee4e5ac86721a666153d19aff9cd8d66c3f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c784246c01000007000000 e8???????? 8d8c24b0000000 c7842460010000ffffffff e8???????? 32c0 e9???????? }
		$sequence_1 = { ebd2 837d0c00 7411 68???????? 8b4508 50 e8???????? }
		$sequence_2 = { 8b8200030000 f7d8 1bc0 83e016 e9???????? 8b4508 83b8fc01000000 }
		$sequence_3 = { e8???????? 83c408 eb24 8b45f0 83c028 50 6a00 }
		$sequence_4 = { e8???????? 8b4df8 8981dc850000 8b55f8 83badc85000000 750a b81b000000 }
		$sequence_5 = { e8???????? 68???????? b9???????? e8???????? 8b45e8 83c408 68ff010f00 }
		$sequence_6 = { c20c00 ff15???????? 8b1d???????? 8b54241c 2bd8 33f6 89442418 }
		$sequence_7 = { be20d182d0 bed0bad0b5 d0bdd0b020d0 b1d0 b5d0 b7d0 bed0bfd0b0 }
		$sequence_8 = { 0f84df040000 83e801 0f8548050000 0fb78570150000 3d4d040000 0f8fa0010000 0f840e010000 }
		$sequence_9 = { e8???????? 83c40c c78570f7ffff9de16300 c7856cf7ffff00000000 c78568f7ffff00000000 c78564f7ffff00000000 c78560f7ffff00000000 }

	condition:
		7 of them and filesize < 6864896
}