MALPEDIA_Win_Ironwind_Auto

rule MALPEDIA_Win_Ironwind_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8199e491-beed-5ae7-9c1e-27bfeb8315e8"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironwind"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ironwind_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "15baeefb1cc07db45d74179ef27970b79e64b5e3c134c8a42e2e1a1cd3935c81"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { b81b000000 e9???????? 488987a8020000 e9???????? 488b8fa8020000 e8???????? 488b87e0000000 }
		$sequence_1 = { 488d0d66790100 e8???????? 488b442438 488905???????? 488d442438 4883c008 488905???????? }
		$sequence_2 = { 48896c2420 57 4154 4157 4883ec30 4d63f8 4d8be1 }
		$sequence_3 = { 4803f1 0f84a9010000 4c8bcf 488d1525330300 4d8bc4 488bcd e8???????? }
		$sequence_4 = { 896c2420 4c8d05928c0300 498bd6 488bcb e8???????? ff15???????? 3930 }
		$sequence_5 = { e8???????? 83f801 0f8596000000 448d482d 4c8d442430 488d542420 8d4816 }
		$sequence_6 = { 488b87e0000000 4885c0 7409 4839b0b8000000 750c 488d8fc00a0000 e8???????? }
		$sequence_7 = { 8903 e9???????? 4c8b08 4d85c9 0f8448030000 81c6ffffefff }
		$sequence_8 = { 4533ed 4c39afc00a0000 0f8436010000 498b16 488d0d42890400 e8???????? }
		$sequence_9 = { 41b849000000 440f45c0 0fbe8280060000 413bc0 741e 488b81a0010000 41b113 }

	condition:
		7 of them and filesize < 995328
}