MALPEDIA_Win_Minitypeframe_Auto

rule MALPEDIA_Win_Minitypeframe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dafa01cc-12f5-5959-a5a8-112bddaf9413"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minitypeframe"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.minitypeframe_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "d2ac69d8f3f2d13991b264b6359d8643129ea3b1d735c1a6bce3fb0ef4022af8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 85c0 7c3e 8b85bc000000 89b0ac000000 8b442434 33c9 8a08 }
		$sequence_1 = { c644247163 c6442472e0 c644247401 c644247525 }
		$sequence_2 = { 751d 6a74 68???????? 6a41 68bd000000 6a14 }
		$sequence_3 = { 68???????? 6a0c 6a09 e8???????? 8b4510 56 50 }
		$sequence_4 = { 89442434 8a08 40 8bf9 8b4d28 85c9 897c242c }
		$sequence_5 = { 7417 3d00010000 7540 b80a000000 8b048550c30a10 8906 }
		$sequence_6 = { 3bcd 742c 8b86d0000000 89bc24fc000000 3bc5 898424f8000000 898c2400010000 }
		$sequence_7 = { 8b349d780e0910 81e10000ff00 81e6000000ff 33ce 8bf2 c1ee18 81e2ff000000 }
		$sequence_8 = { 83c408 85c0 7479 8b442434 8b4d00 03c7 81f9fffe0000 }
		$sequence_9 = { e8???????? 8bf8 83c40c 3bfb 0f8e42030000 395e6c }

	condition:
		7 of them and filesize < 1589248
}