MALPEDIA_Win_Minibrowse_Auto

rule MALPEDIA_Win_Minibrowse_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9f6650b8-5239-5032-886e-aed87970db71"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minibrowse"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.minibrowse_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "431afaa525f2fb5fee467730f29c5866714cce8b22c1963aa09f9eeafdd7fb92"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488b4010 488b0c24 488b09 48ba519faa8c11c54d25 4801d0 4829c8 48b9519faa8c11c54d25 }
		$sequence_1 = { 4c63c8 428a140a 88542407 41b91d000000 31d2 41f7f1 8b442410 }
		$sequence_2 = { 48b8285a895ec1288634 49034338 4c89542420 ffd0 488b4c2478 48bae4ae95c06d509bd8 }
		$sequence_3 = { f7f1 89c1 83e928 48b81ca6e955db0a66e9 480305???????? 8908 48b81ca6e955db0a66e9 }
		$sequence_4 = { 48b84933c445a4f5a43d 480305???????? 8b00 8945ac 4189c0 4183e01f 4183c801 }
		$sequence_5 = { 488b842488000000 4889442438 488b4c2460 48ba43826c17761a1b3b 480315???????? 48b8e2603ff4395df8be 48034230 }
		$sequence_6 = { 488b4c2438 49b887c7de1b22f1b6a7 4c0305???????? 48b8584182a86aca4fb4 490300 ffd0 488b542428 }
		$sequence_7 = { f7f1 89c1 83e92f 48b894f60aea1b77f0c0 480305???????? 8908 48b894f60aea1b77f0c0 }
		$sequence_8 = { 80e101 0fb6c9 01ca 48b90080d46689848625 48030d???????? 8911 a801 }
		$sequence_9 = { f7f1 89c1 48b815ac4d524d475ce8 480305???????? 8908 48b815ac4d524d475ce8 480305???????? }

	condition:
		7 of them and filesize < 1779712
}