MALPEDIA_Win_Lunchmoney_Auto

rule MALPEDIA_Win_Lunchmoney_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "277f90a2-3135-5ec3-8a77-6614557936f0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lunchmoney"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.lunchmoney_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "d1a4a2b80be0520c1b33306269406a6ad78ba8c181288c038ea2087ddb9ff427"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a24 b8???????? e8???????? 8d45d4 81c160090000 50 }
		$sequence_1 = { 56 e8???????? 83ec0c 8bcc 56 e8???????? }
		$sequence_2 = { 89a5ecfeffff 53 e8???????? 83ec18 c645fc05 8bcc 56 }
		$sequence_3 = { 59 c1e006 0304b550914200 59 5e eb05 b8???????? }
		$sequence_4 = { 3bf7 7461 56 8d4dd8 e8???????? c645fc03 8d4dd8 }
		$sequence_5 = { 8bec 83e4f8 51 53 56 8bf1 bb???????? }
		$sequence_6 = { 03c7 ebc6 5f 5e 5b 8be5 5d }
		$sequence_7 = { e8???????? 56 8bd3 8bc8 e8???????? 59 }
		$sequence_8 = { 6a00 f3a4 50 e8???????? 8bb5e0feffff 59 }
		$sequence_9 = { 7405 e8???????? dbe2 5d c3 b8???????? c705????????e1244100 }

	condition:
		7 of them and filesize < 373760
}