MALPEDIA_Win_Hodur_Auto

rule MALPEDIA_Win_Hodur_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e3722ba4-9330-5acf-a001-36d58f674969"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hodur"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.hodur_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "3004265ec10071e206b1f9b36449d098d336382ccfd9415098927b3da32456f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f30f7f03 66c743101b3e 884312 7c12 a1???????? 8d48ff 0fafc8 }
		$sequence_1 = { e8???????? 6a64 ffd0 e9???????? 83feff 0f848c010000 895de4 }
		$sequence_2 = { c78540ffffff00000000 898588fdffff 83bd40ffffff0c 0f8338000000 8b8540ffffff 8b8d88fdffff 0fbe0401 }
		$sequence_3 = { e9???????? 6a3a ff75f0 e8???????? 83c408 833d????????0a 7c20 }
		$sequence_4 = { 0fafd0 83e201 7402 ebfe e8???????? 6a00 ff7604 }
		$sequence_5 = { c64424325a ebb2 833d????????0a c644243300 7c12 a1???????? 8d48ff }
		$sequence_6 = { c644245400 c74424506c202530 c744244c0d0a6465 ff742460 ff742468 8d84245c090000 50 }
		$sequence_7 = { e8???????? 57 ffd0 8b15???????? 8d4aff 0fafca }
		$sequence_8 = { c74750ee00dd00 c74754d000f600 c74758ea008500 66899fb6000000 7c12 a1???????? 8d48ff }
		$sequence_9 = { 8b7e18 57 e8???????? 83c40c 0f2805???????? b8ecffffff 0f1103 }

	condition:
		7 of them and filesize < 1067008
}