MALPEDIA_Win_Minipocket_Auto

rule MALPEDIA_Win_Minipocket_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4bfe3841-9649-5ffe-8c95-c50da79d5d8c"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minipocket"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.minipocket_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "f99d6584928c86c24bca7d34fc6463d62a033b67ff2c46d0cd8c512898739c50"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83f83b 0f87ba000000 8b7df0 8bc7 }
		$sequence_1 = { 488364242800 4533c9 488364242000 488bc8 458d4110 }
		$sequence_2 = { 456bc021 4403c0 ffc7 8bc7 8a0417 84c0 75eb }
		$sequence_3 = { 4c8d9c24d0020000 498b5b18 498b7b20 498be3 }
		$sequence_4 = { c744245492469e5a ff15???????? 488bd8 4883f8ff 0f8412010000 488364243000 488d542450 }
		$sequence_5 = { 410fb70449 6685c0 75ea 413bd3 7419 413bd2 }
		$sequence_6 = { eb11 0fbec0 456bc021 4403c0 ffc7 8bc7 }
		$sequence_7 = { 498b4010 4c8b00 eb30 410fb701 }
		$sequence_8 = { 443bc5 7421 ffc1 4983c204 3bce 72ca 33c0 }
		$sequence_9 = { 7474 ba68000000 488d4d80 e8???????? ba18000000 c7458068000000 488d4c2460 }

	condition:
		7 of them and filesize < 34816
}