MALPEDIA_Win_Miniblindingcan_Auto

rule MALPEDIA_Win_Miniblindingcan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f214879d-739e-57b2-a68d-dbf4545e3571"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniblindingcan"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.miniblindingcan_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "e6766a841610f22d39169ab97524cdd6c4e6776e0503922f6cba75e01b90a41c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488d1585730100 488905???????? ff15???????? 488b0d???????? 488d1582730100 488905???????? }
		$sequence_1 = { ff15???????? 83cbff 85c0 7527 488d85f0050000 4c8d45e0 448bcb }
		$sequence_2 = { 488d052e4a0000 488905???????? e9???????? 81fbd73a0000 7513 488d05084a0000 }
		$sequence_3 = { ff15???????? 488d0d4e790100 488bd0 488bf8 e8???????? }
		$sequence_4 = { ff15???????? 85c0 7517 ff15???????? 3dea000000 7404 33c0 }
		$sequence_5 = { 488d6c24b9 4881ecc0000000 488b05???????? 4833c4 48894537 33c0 488bd9 }
		$sequence_6 = { 89742440 e8???????? 488d4de1 33d2 41b8ff010000 }
		$sequence_7 = { e9???????? 4c8d4daf 4c8d45bf 488d4dcf 8bd3 }
		$sequence_8 = { 488bcb ff15???????? 488b4c2458 ff15???????? b801000000 488b8da0050000 4833cc }
		$sequence_9 = { 488905???????? e9???????? 81fb634a0000 7513 488d05ef310000 488905???????? e9???????? }

	condition:
		7 of them and filesize < 453632
}