MALPEDIA_Win_Glasses_Auto

rule MALPEDIA_Win_Glasses_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6d9b306c-9dac-5e6c-ad9a-a63b32b10956"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glasses"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.glasses_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8b4a36bf80c06e78f0e21d1167cf3a3f85699bce5684fa4db409f4ed268e2716"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb43 8bce e8???????? c6462d01 c7463017000000 c746340d000000 e8???????? }
		$sequence_1 = { e8???????? 8d049d00000000 50 56 8bcf e8???????? 84c0 }
		$sequence_2 = { eb3e 68???????? 8d8b88000000 e8???????? 84c0 740c 68???????? }
		$sequence_3 = { e8???????? 84c0 7465 8d8d60feffff e8???????? 80381f 7555 }
		$sequence_4 = { e8???????? 8bf0 83c404 85f6 0f8494f8ffff 680d010000 8bce }
		$sequence_5 = { e8???????? 8d4dac e8???????? 8b96c8010000 83c234 52 8d4dac }
		$sequence_6 = { e8???????? 8b8ec8010000 83c134 e8???????? 8b8ec8010000 50 83c134 }
		$sequence_7 = { e8???????? 8b45e4 40 8945e4 3b4514 7280 8d4db4 }
		$sequence_8 = { e8???????? 8b0d???????? 85c9 74e2 c645ff00 e8???????? 8b0d???????? }
		$sequence_9 = { 8be5 5d c3 8d5702 3bf2 733f 8b5d24 }

	condition:
		7 of them and filesize < 4177920
}