MALPEDIA_Win_Hlux_Auto

rule MALPEDIA_Win_Hlux_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "28ebfc66-b36a-5b32-9f44-3572498887c2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hlux"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.hlux_auto.yar#L1-L155"
		license_url = "N/A"
		logic_hash = "e9222c023df7fd2f3b9e4049ffc25496a4c78e57da3831eefa238e14364a3c6e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83f99c 7429 8955e8 895de8 8d91c966fec6 8975d8 }
		$sequence_1 = { 83f873 0f8580000000 83f8cb 757b ba11d8778b }
		$sequence_2 = { 0009 1b4e01 e405 9d }
		$sequence_3 = { 8945d0 8b7d08 33c0 894dd4 8bf7 }
		$sequence_4 = { 0f8476010000 8d0452 897da0 33f6 }
		$sequence_5 = { 8d08 83f946 7508 83f9ff 7403 }
		$sequence_6 = { 56 33d2 33f6 8975cc 8955cc 57 bec97b4de2 }
		$sequence_7 = { 898d1cffffff 899564ffffff 53 b81da2c0bb }
		$sequence_8 = { 010f 840f 0000 008365f0fe8b }
		$sequence_9 = { 0101 c9 c3 6a10 }
		$sequence_10 = { 0088aa4b0023 d18a0688078a 46 018847018a46 }
		$sequence_11 = { 895de8 85c9 7503 894df0 ff4de4 }
		$sequence_12 = { 0000 008365f0fe8b 4d 0883c108e918 }
		$sequence_13 = { 0104bb 8d1447 89542418 e9???????? }
		$sequence_14 = { 0104b9 33c9 83c408 85c0 }
		$sequence_15 = { 0130 8b13 8b08 85d2 }

	condition:
		7 of them and filesize < 3147776
}