MALPEDIA_Win_Flame_Auto

rule MALPEDIA_Win_Flame_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5fe3e6d2-6698-50d6-916f-b37f13216be6"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flame"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.flame_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "8f555ca35148ecb33315122be41be7225ffb4ae39d1e9243b0934ee30005950d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 741a 83f901 7415 e8???????? c70016000000 }
		$sequence_1 = { 8bc3 442bfb 4c03e8 4533db }
		$sequence_2 = { 57 50 895dd0 895dd4 e8???????? 83c40c 85c0 }
		$sequence_3 = { 8bc3 488b9c2480010000 4881c450010000 415d }
		$sequence_4 = { 8365fc00 e9???????? b8???????? e8???????? 83ec28 }
		$sequence_5 = { ffd7 90 eb00 4883c430 5f 5e }
		$sequence_6 = { 8bc3 4823c8 8b348e eb27 f6c240 0f8539020000 }
		$sequence_7 = { 83fb10 741c 83fb18 740e 83fb20 7519 }
		$sequence_8 = { 8bc3 482bd0 448bc3 44396710 }
		$sequence_9 = { 742a ffc9 0f84f4000000 ffc9 }
		$sequence_10 = { 8b721c 3bf0 7447 39420c 7442 3902 7505 }
		$sequence_11 = { 8bc3 4823c2 eb22 f6c210 7547 f6c240 0f85d1020000 }
		$sequence_12 = { 33c0 eb2c 6aff 56 ff15???????? 59 59 }
		$sequence_13 = { 1bc0 c1ee1e f7d8 83e601 c1ef1f }
		$sequence_14 = { 83f8ff 7516 8d4dd4 e8???????? 68???????? 8d45d4 }

	condition:
		7 of them and filesize < 1676288
}