MALPEDIA_Win_Funksec_Auto

rule MALPEDIA_Win_Funksec_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea8df678-b347-5866-9532-54e6fe25b51e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.funksec"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.funksec_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "295467c18b944fb09944a901e783dbbba9dffb3c056bc94460c476e9b4c73249"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb32 410fb6411c 450fb64101 410fb65102 410f104103 0f2985c0050000 450fb6511b }
		$sequence_1 = { eb3f c6858f00000000 c6858e00000000 4c8d05cf7a2300 4c89f1 e8???????? eb20 }
		$sequence_2 = { e9???????? 48c1e808 488b7de8 4939f6 0f8288feffff 4c8d054bf31000 4c89f1 }
		$sequence_3 = { f3410f6f4c0d10 660fefd2 660ff8d0 660fdad0 660fefc0 660ff8c1 660fdac1 }
		$sequence_4 = { f04c0fb137 0f8428020000 4183fd06 b806000000 410f42c5 b901000000 4585ed }
		$sequence_5 = { e8???????? 4889c3 4885c0 7453 0f1005???????? 0f1103 c6431072 }
		$sequence_6 = { f3420f6f0433 66440fd7d0 4983c310 4585d2 74e6 f3450fbcd2 4d01f2 }
		$sequence_7 = { eb4d 4983c403 c1e10c 09ca 4189d5 4181fd00010000 7338 }
		$sequence_8 = { e8???????? c7451000000000 488b5dd0 4c8b65d8 41bd04000000 4c8d7510 488b75e0 }
		$sequence_9 = { ff5018 488b45f0 488b8010020000 4885c0 7416 f048ff08 7510 }

	condition:
		7 of them and filesize < 10986496
}