MALPEDIA_Win_Httpdropper_Auto

rule MALPEDIA_Win_Httpdropper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f8aedc90-46c4-5f78-8238-405fbade7c86"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpdropper"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.httpdropper_auto.yar#L1-L155"
		license_url = "N/A"
		logic_hash = "61904ad49a2543e412a09c3ebcb816d4ba3cbc7ad62a8d3b1cf9fe23e0dab3ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 7539 8d95e4f8ffff 52 8b95e8f8ffff }
		$sequence_1 = { 8d8de8feffff 51 ff15???????? 68e8030000 }
		$sequence_2 = { 745e 81fe78010000 740c 81fea6010000 0f85bb050000 }
		$sequence_3 = { 3acb 75f9 8b8de0f8ffff 2bc2 }
		$sequence_4 = { 51 e8???????? 83c408 85c0 7538 8b141e }
		$sequence_5 = { 89834c400000 e8???????? 8b4d08 89833c400000 33c0 }
		$sequence_6 = { 33f6 3933 742e 807c241300 7515 6a0c }
		$sequence_7 = { 68ff000000 e8???????? 59 59 8b7508 8d34f5907d0310 }
		$sequence_8 = { 84c0 75ed 488d8d80040000 ba5c000000 }
		$sequence_9 = { 488d4c2454 33d2 41b83c010000 c744245000000000 }
		$sequence_10 = { be02000000 48898358400000 33c0 0fb7cd }
		$sequence_11 = { e8???????? 488d0d88540100 0fb744f102 8983e0af0600 }
		$sequence_12 = { e8???????? 4c8d9c2470100000 498b5b18 498b7320 }
		$sequence_13 = { 488bd8 4885c0 74c6 488bc8 }
		$sequence_14 = { 4533c9 4533c0 488bd3 488bc8 48896c2428 }
		$sequence_15 = { 8d51ff 488d4df0 e8???????? 488bf0 }

	condition:
		7 of them and filesize < 524288
}