MALPEDIA_Win_Gearshift_Auto

rule MALPEDIA_Win_Gearshift_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3d63cf91-17d7-5a6a-9d1d-b27b1e5f74cb"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gearshift"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.gearshift_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "637a6702d268d4bd9cab6e76f4de20ea36be87939de1600665a2e21687ff9d0c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ff15???????? 85c0 0f84a3000000 8b8db0010000 e8???????? }
		$sequence_1 = { 85c0 7589 8d7801 488bcb }
		$sequence_2 = { 488bd8 4885c0 7424 ff9608010000 3db7000000 7517 488bcb }
		$sequence_3 = { 4c8d258e140300 488b0d???????? eb7c 4c8d2576140300 488b0d???????? eb6c e8???????? }
		$sequence_4 = { 4c8be8 4885db 7510 488d0d5db00000 ff15???????? 488bd8 }
		$sequence_5 = { 4883c440 5f e9???????? 488b5c2450 488b742458 4883c440 }
		$sequence_6 = { 488bd8 ff15???????? 488d15d4a90000 488bcb 488905???????? ff15???????? }
		$sequence_7 = { 488bd8 ff15???????? 488d15e2bc0000 488bcb 488905???????? }
		$sequence_8 = { 57 4154 4156 4157 488dac2488feffff 4881ec78020000 33c0 }
		$sequence_9 = { 488d05481f0300 4c3bd0 7405 e8???????? }

	condition:
		7 of them and filesize < 540672
}