MALPEDIA_Win_Jlorat_Auto

rule MALPEDIA_Win_Jlorat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba729196-a7d7-59f0-9c40-f4da7d10b781"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jlorat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.jlorat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "89ee6f5af4bbc0ca3930c558eb44fe3b46ffa971fd86650e68795fe094f9760a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f20f1085b0feffff f20f1185c0feffff 89e0 8d8dc0feffff 8908 e8???????? 899598feffff }
		$sequence_1 = { eb00 eb02 ebfc 837dc000 0f94c0 a801 7502 }
		$sequence_2 = { f6464501 7522 eb06 c6463b01 ebf2 8a463b 8b4e58 }
		$sequence_3 = { e8???????? 8b458c 8b4de8 64890d00000000 83c478 5e 5f }
		$sequence_4 = { eb00 c745f000000000 89e0 8d8d1cffffff 8908 e8???????? e9???????? }
		$sequence_5 = { f20f1045d4 c745dc00000000 c745d800000000 66c745e00000 f20f1055d4 f20f104ddc 894808 }
		$sequence_6 = { f7e1 898518ffffff 0f90c0 a801 753d eb20 89e0 }
		$sequence_7 = { f20f1145ac f20f1045bc f20f1055ac f20f104db4 f20f118578ffffff f20f118d70ffffff f20f119568ffffff }
		$sequence_8 = { f20f108620040000 f20f11863c030000 f20f108610040000 f20f108e18040000 f20f118e34030000 f20f11862c030000 88866c030000 }
		$sequence_9 = { f20f10860c020000 f20f118600020000 8b08 83c144 c786680f000008000000 89e0 8908 }

	condition:
		7 of them and filesize < 10952704
}