MALPEDIA_Win_Ktlv_Door_Auto

rule MALPEDIA_Win_Ktlv_Door_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b72e81ca-7d5e-5297-bbe9-6aa7902659a6"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ktlv_door"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ktlv_door_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "5ac69720388308c80b5a37adfc511292d61061e883af5a51db60316becc21ed1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ffd0 488b5c2440 488b442430 488b4c2448 488b6c2458 4883c460 c3 }
		$sequence_1 = { 4c8d4301 4901c9 4983f804 0f8ca1feffff 4c89d3 4889d9 488bbc24d8000000 }
		$sequence_2 = { eb6a 488d942460010000 4889942460010000 488b8c2470010000 488d7101 488b9c2468010000 488bbc2478010000 }
		$sequence_3 = { c3 4889c1 90 e8???????? 90 4889442408 48895c2410 }
		$sequence_4 = { 90 e8???????? 48c7400825000000 488d0dbd902a00 488908 488b8c24d0000000 488b9424d8000000 }
		$sequence_5 = { e8???????? 488d0574451000 488b9c24e8010000 488b8c24e0010000 488bbc2408010000 e8???????? 48c7400801000000 }
		$sequence_6 = { c3 81f9ce80d5ec 7510 488d0dc75e3000 4839c8 7436 6690 }
		$sequence_7 = { 4c89ac2440010000 4c89e7 4c89f9 e8???????? 488d05814b1b00 4c89eb e8???????? }
		$sequence_8 = { e8???????? 48c7400819000000 488d0d0d502f00 488908 31db 31c9 488d3d8d8e3900 }
		$sequence_9 = { e8???????? 488b842488000000 0fb610 488b4c2458 4889cb 48c1e103 4c8b9c24c0000000 }

	condition:
		7 of them and filesize < 14630912
}