MALPEDIA_Win_Nim_Blackout_Auto

rule MALPEDIA_Win_Nim_Blackout_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "048267f7-62fb-507b-b119-68debffc7bf9"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nim_blackout"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.nim_blackout_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "06823db7fdc0487e1c01e7b7292944b80bcc51abb9b98ed51feb95984ce49f66"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4889e5 4881ecf0000000 48894d10 48895518 488d0589840200 48898538ffffff 488d0536820200 }
		$sequence_1 = { 782e 488b85a0000000 488b4040 4885c0 }
		$sequence_2 = { 488d14c500000000 488b4518 4801d0 488b00 4885c0 742d 48c745d07d000000 }
		$sequence_3 = { 488d45c8 488910 4889c8 83e001 84c0 7405 e8???????? }
		$sequence_4 = { eb05 b800000000 4801d0 4889c1 e8???????? 48898588000000 488b9580000000 }
		$sequence_5 = { e8???????? 488b45b0 488945f8 48c745d025010000 488d0592090100 488945d8 }
		$sequence_6 = { 4821c2 488b4510 488910 48c745c0a8000000 488d0591790200 488945c8 488b4510 }
		$sequence_7 = { 488b45f0 488945f8 e9???????? 90 48c745c0bb000000 488d0559820100 488945c8 }
		$sequence_8 = { 0f8e9e040000 c64424302e 488d442431 c60030 488d5801 458b54240c bd02000000 }
		$sequence_9 = { 488945d8 c645f600 48837d1800 7409 488b4518 488b00 eb05 }

	condition:
		7 of them and filesize < 1068032
}