MALPEDIA_Win_Lumma_Auto

rule MALPEDIA_Win_Lumma_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f2244960-3b18-5468-827a-79d29ee0dbef"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.lumma_auto.yar#L1-L195"
		license_url = "N/A"
		logic_hash = "0e65c60ec7841d9a3110bc5423f06dcbfbc8da401420dfec59cc9b0939489cdf"
		score = 75
		quality = 71
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 57 53 ff767c ff7678 ff7644 }
		$sequence_1 = { 894614 8b461c c1e002 50 }
		$sequence_2 = { ff7678 ff7644 ff563c 83c414 }
		$sequence_3 = { ffd0 83c40c 894648 85c0 }
		$sequence_4 = { 833800 740a e8???????? 833822 }
		$sequence_5 = { 66894316 0fb7560e 0fb74e0c e8???????? }
		$sequence_6 = { 8b4610 894320 8b4614 894328 }
		$sequence_7 = { 66894338 8b4626 89433c 8b462a 894340 }
		$sequence_8 = { 017e78 83567c00 017e68 83566c00 }
		$sequence_9 = { 83c40c 6a02 6804010000 e8???????? }
		$sequence_10 = { 01c9 39dd ba00000000 19c2 }
		$sequence_11 = { 234608 7418 8b8684000000 29f8 }
		$sequence_12 = { 01dc 41 5d 41 }
		$sequence_13 = { 0f94c3 89d5 09cd 0f95c7 30df 7514 837e6c00 }
		$sequence_14 = { 31c0 837e3808 0f94c0 294628 }
		$sequence_15 = { 01e8 56 ff742424 50 }
		$sequence_16 = { 49 c7c600000000 44 8b5510 44 8b750c }
		$sequence_17 = { 50 57 ff7618 e8???????? 83c40c 894618 }
		$sequence_18 = { 56 41 57 41 54 41 }
		$sequence_19 = { 30df 7514 837e6c00 750e 8b6e68 837c242804 }
		$sequence_20 = { 50 55 e8???????? 83c40c 8b4b04 }

	condition:
		7 of them and filesize < 1115136
}