MALPEDIA_Win_Fudmodule_Auto

rule MALPEDIA_Win_Fudmodule_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9482c0b3-e233-5fbb-b7f9-15eeefb47cbe"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fudmodule"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.fudmodule_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "598ae8f286914fa01f5c87db15072d98763fc039c41db282c8e23ad8eab8fdd6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4883c701 d2d8 fec0 f6d0 }
		$sequence_1 = { 440fb74318 488d4c2420 4803d3 e8???????? 488d4c2420 e8???????? }
		$sequence_2 = { 488d4c1005 493bce 7503 41ffc1 453bc8 7e27 }
		$sequence_3 = { 488d6c24c9 4881ecd0000000 488b05???????? 4833c4 48894527 33c0 4533ed }
		$sequence_4 = { 4889fa 66d3d1 66c1d90f 660fadc9 4889d9 f5 }
		$sequence_5 = { 488d15cc390000 488bce 488905???????? ff15???????? }
		$sequence_6 = { 6641398320010000 7664 8bce 4863c1 488d542434 440fb7440460 }
		$sequence_7 = { 660fabf3 18c3 4883c420 660fb6da 4889c3 }
		$sequence_8 = { d2e5 488b7518 660fa4f109 6689f1 88d5 66b937f3 }
		$sequence_9 = { c7459c72546872 c745a065616400 ff15???????? 488d542448 488bc8 488bd8 }
		$sequence_10 = { 488d442458 41b932000000 4c8bc7 4889442420 }
		$sequence_11 = { f6c413 f5 84c0 e9???????? f5 }
		$sequence_12 = { 0f878cb40100 f5 69d20a000000 f6c63b f9 }
		$sequence_13 = { 7329 4863d1 488d0d40bc0000 488bc2 83e21f 48c1f805 }
		$sequence_14 = { 66f7d6 6631fe 4889e6 66f7c12173 f9 }
		$sequence_15 = { 6685f5 f6dd 8b8e8c000000 f8 6685fd e9???????? 660fa3c1 }

	condition:
		7 of them and filesize < 795648
}