MALPEDIA_Win_Grateful_Pos_Auto

rule MALPEDIA_Win_Grateful_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1107fae2-2967-57c7-a209-7f535055762a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.grateful_pos_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "fa9b4d7574f7dfc03c60360742077f74a349f1193ef7c8f8805fa4124390cf09"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 7407 b8f6ffffff eb02 33c0 }
		$sequence_1 = { eb1a b8fdffffff eb13 b8fcffffff }
		$sequence_2 = { 7411 e8???????? e8???????? 33c0 e9???????? }
		$sequence_3 = { e8???????? 99 b980ee3600 f7f9 }
		$sequence_4 = { 83f801 7510 e8???????? e8???????? }
		$sequence_5 = { eb07 b8fcffffff eb02 33c0 }
		$sequence_6 = { 0fb68415fdfffdff 85c0 752b 68???????? 8b4d08 8b5104 }
		$sequence_7 = { 0fb64d0c ba08000000 2bd1 8bca d3e0 }
		$sequence_8 = { 83bddcfbffff46 0f8dbe000000 c785c0fbffff00000000 eb0f 8b8dc0fbffff }
		$sequence_9 = { 6a02 8b85dcfbffff 8b4d0c 8d1441 }
		$sequence_10 = { 741d 8b5508 8955fc 8b4508 8b481c }
		$sequence_11 = { e9???????? 8b95f8fffdff 0fb68415fbfffdff 83f830 7c6d }
		$sequence_12 = { 8b4010 880c10 e9???????? 8b8decfffdff 2b8de8fffdff }
		$sequence_13 = { 83f901 0f8584000000 c785dcfbffff01000000 eb0f 8b95dcfbffff }
		$sequence_14 = { b801000000 486bc002 488d0d1fe70100 0fbe0401 83f04d 88842402010000 }
		$sequence_15 = { 488d0d39c00900 e8???????? 41b900040000 4c8d0527c00900 33d2 488b8424a0000200 488b08 }

	condition:
		7 of them and filesize < 3964928
}