MALPEDIA_Win_Misfox_Auto

rule MALPEDIA_Win_Misfox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad4a465e-502d-557b-9df0-0d09a5d58c98"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misfox"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.misfox_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "f0284d77322fd81fc80799ff8b17c387a5c86ef9b47522a47cced1f49d8f1bd3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ddd8 db2d???????? b801000000 833d????????00 0f8536510000 }
		$sequence_1 = { 8bf7 8906 8d7604 40 3d00010000 7cf3 c745fc00000000 }
		$sequence_2 = { 8d44241c 50 6a01 8d442420 50 8d442440 50 }
		$sequence_3 = { 8b0c8550870110 8b8524e5ffff f644080480 0f8475030000 8b9530e5ffff 33ff 89bd34e5ffff }
		$sequence_4 = { c3 8bc1 85f6 7409 }
		$sequence_5 = { 7f0a b80a000000 5e 8be5 5d c3 53 }
		$sequence_6 = { ff74241c ffd6 85c0 7560 8b3d???????? }
		$sequence_7 = { 83e908 8d7608 660fd60f 8d7f08 8b048d08410010 }
		$sequence_8 = { 488d4dff ba00020000 c745cb00020000 448975c7 }
		$sequence_9 = { e8???????? 8b430c 4c8d6708 894308 8b470c }
		$sequence_10 = { 488bc3 488b5c2430 4883c420 5f c3 488d0d4c6f0100 }
		$sequence_11 = { 48837d0810 4c0f434df0 488d4d10 48837d2810 480f434d10 8b4500 }
		$sequence_12 = { eb15 413bc4 753e 0fb65530 0fb64531 }
		$sequence_13 = { 8d41fa 83f801 7774 488b4dbf ff15???????? 83f826 }
		$sequence_14 = { 488bc3 488bfb 48c1ff05 4c8d3526d20000 83e01f 486bf058 498b04fe }
		$sequence_15 = { 4833c4 48894547 488d0d615f0100 ff15???????? 488d4def ba00080000 }

	condition:
		7 of them and filesize < 266240
}