MALPEDIA_Win_Mim221_Auto

rule MALPEDIA_Win_Mim221_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6b3ca20b-0128-5dd4-ae44-a9ad20468513"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mim221"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.mim221_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "c8ab0bebcf8a5d049b64e0dbc52faacc83c56fe19f5796af9fe2c171bbbea243"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488d542450 488d4c2460 41b868000000 e8???????? 413bc6 746a 488b842460010000 }
		$sequence_1 = { 7408 8bcb ff15???????? 48897c2448 e8???????? 488d1ddaf10000 488d3dfbf10000 }
		$sequence_2 = { 33d2 458d462e 488d8c24ca000000 e8???????? c684249003000044 c68424910300008b c684249203000001 }
		$sequence_3 = { e8???????? 4c8b1d???????? 4c3bdd 760b }
		$sequence_4 = { c784241c07000004000000 e8???????? c784244007000000280000 899c2448070000 488d842490080000 488d8c2470070000 4c8bc6 }
		$sequence_5 = { e8???????? 413bc7 7424 48634f30 4c8d4530 488d542450 }
		$sequence_6 = { 488b4310 80784900 7513 488bd8 488b00 80784900 74f4 }
		$sequence_7 = { 66c74424447300 66c74424464900 66c74424486e00 66c744244a6300 66c744244c7200 66896c244e 66c74424506d00 }
		$sequence_8 = { 0f8c3fffffff 4585ff 745e 488b442450 c64424600d 488d0df47d0100 488b0cc1 }
		$sequence_9 = { 8b842404010000 4903c4 4889442470 8b8424f8000000 4a8b0c20 48894c2458 4c8b8788000000 }

	condition:
		7 of them and filesize < 471040
}