MALPEDIA_Win_Fatduke_Auto

rule MALPEDIA_Win_Fatduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fa43f7a1-5b72-519a-ba87-112b516efd99"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.fatduke_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "823f29cda72367b334bd8f12bb466104e5c3e5cae142985544db044753352739"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c78540ffffff00000000 c78544ffffff00000000 c78544ffffff0f000000 c78540ffffff00000000 c68530ffffff00 803a00 7504 }
		$sequence_1 = { c645fc0e 837de010 720b ff75cc e8???????? 83c404 c745e00f000000 }
		$sequence_2 = { c7863401000000000000 c6862401000000 c645fc0a 83be2001000010 720e ffb60c010000 e8???????? }
		$sequence_3 = { 8d34c1 ff37 8bd6 e8???????? 83c404 ff75ec 51 }
		$sequence_4 = { ff750c 8bf1 ff7508 c70600000000 c7460400000000 c7460800000000 e8???????? }
		$sequence_5 = { e8???????? 83c418 c645fc0a 8b4dd0 8b01 ff5004 33c0 }
		$sequence_6 = { ff7620 e8???????? 83c404 c746340f000000 c7463000000000 c6462000 c745fcffffffff }
		$sequence_7 = { 7505 895110 eb1a 894de8 894de4 c645fc02 c701???????? }
		$sequence_8 = { ff7510 c706???????? ff7508 e8???????? c745fcffffffff 8bc6 8b4df4 }
		$sequence_9 = { e8???????? 5e 84c0 7407 8b4728 83700801 8bcf }

	condition:
		7 of them and filesize < 9012224
}