MALPEDIA_Win_Htprat_Auto

rule MALPEDIA_Win_Htprat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2a40ad4e-1514-53dd-8180-69420f7bc60e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htprat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.htprat_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "9b31ea685effc72070edec20cdbb0f150b670c182033265ef40f9b7f10fd4d1d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 50 e8???????? ffb568efffff e8???????? 59 }
		$sequence_1 = { a3???????? 53 8d854cdcffff 50 8bce e8???????? c78540dcffff01000000 }
		$sequence_2 = { 8b4d08 83c10c 8bc3 e8???????? 84c0 7445 }
		$sequence_3 = { c745cc73747576 c745d07778797a c745d441424344 c745d845464748 c745dc494a4b4c c745e04d4e4f50 c745e451525354 }
		$sequence_4 = { c6400401 eb3c 8d45f8 e8???????? 8b4df8 83c10c 8bc3 }
		$sequence_5 = { 7705 83c2d0 eb1c 83fa41 720a 83fa46 7705 }
		$sequence_6 = { 8b01 8945d0 3bc1 744e }
		$sequence_7 = { a1???????? 33c4 50 8d8424e0000000 64a300000000 33db c744245c0f000000 }
		$sequence_8 = { 6a16 ffb574efffff 89bd6cefffff ffd6 3bc7 750b }
		$sequence_9 = { 50 e8???????? 83c40c 8d85e8fdffff 6a0c 898524efffff }

	condition:
		7 of them and filesize < 278528
}