MALPEDIA_Win_Gratem_Auto

rule MALPEDIA_Win_Gratem_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "39e4b7fa-cb1e-558e-a3c1-898c2f1d94ee"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gratem"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.gratem_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "1065bb2e98023fbfca2a244eed1cca397cf6e69cb43c64edf47cc545c8854662"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 85f6 751b 83c8ff 5e 8b8c24d0070000 }
		$sequence_1 = { 68???????? 89742428 c74424489ca24000 8974244c }
		$sequence_2 = { 0f8461020000 0fb7048d64bc4000 41 6685c0 75e4 }
		$sequence_3 = { 50 68???????? e8???????? 68f4010000 8bce }
		$sequence_4 = { 56 ffd5 6a04 894714 }
		$sequence_5 = { 89442438 ffd6 68???????? 57 8944243c ffd6 68???????? }
		$sequence_6 = { 8945e4 8b7508 c7465c38984000 33ff 47 897e14 85c0 }
		$sequence_7 = { ba6bc10000 663bc2 0f84bc010000 0fb7048d64bc4000 41 6685c0 }
		$sequence_8 = { ff15???????? 50 ff15???????? 89442418 85c0 745b 8b442414 }
		$sequence_9 = { 53 56 ff15???????? 89442414 85c0 }

	condition:
		7 of them and filesize < 155648
}