MALPEDIA_Win_Green_Dispenser_Auto

rule MALPEDIA_Win_Green_Dispenser_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f68f99bd-67a1-5d16-ab8e-4b1776b63b08"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.green_dispenser"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.green_dispenser_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "43c9d3a0c017d323803714c391c503baf5f0bb9068bbac7ba368336725aa1907"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83c1fe 57 03f1 b8???????? bf05000000 0fb648fe 880e }
		$sequence_1 = { 8b4df0 8b45fc 0375f8 037df4 41 83c404 83c310 }
		$sequence_2 = { 7e07 83ff1a 0f9fc0 40 8b3485f8e34200 8b4304 99 }
		$sequence_3 = { f6d2 80e201 32d3 8816 8b55fc 8b5d08 41 }
		$sequence_4 = { 6a08 8bf9 e8???????? 8bf0 83c404 85f6 740d }
		$sequence_5 = { 8845f9 8d45ec 50 8d45f0 50 6a00 6a00 }
		$sequence_6 = { 747f 83fb03 7d34 e8???????? c70016000000 8b770c }
		$sequence_7 = { 740a 48 740a 48 48 7568 40 }
		$sequence_8 = { 8b048550aa4500 f644180401 7418 ff7514 ff7510 ff750c 57 }
		$sequence_9 = { 57 8bf9 6a08 8bda 897dfc e8???????? }

	condition:
		7 of them and filesize < 838656
}