MALPEDIA_Win_Ondritols_Auto

rule MALPEDIA_Win_Ondritols_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f1b815f1-229d-587f-9b83-698adf9033b8"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ondritols"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ondritols_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "5c8bafb3ef1aa0c6c467b3ea0bd2b3c727b4a1c0491ef4c729d846f51f47fabb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 898558ffffff 895804 33c9 8908 8b8558ffffff 8d9558ffffff 8910 }
		$sequence_1 = { 8d542412 c6474901 39542424 0f8533010000 85db 7517 }
		$sequence_2 = { 59 894df8 8b45f8 8b4df8 8b5054 2b5158 3b550c }
		$sequence_3 = { 8b4508 50 8b4de8 e8???????? e9???????? 8b45a0 6bc00a }
		$sequence_4 = { 50 57 6a00 68e9fd0000 ffd3 8bf0 8bc7 }
		$sequence_5 = { c22000 c745fcffffffff 837d2010 720c 8b450c 50 e8???????? }
		$sequence_6 = { 51 8b4dec e8???????? 8985acfdffff c645fc04 8d45d8 }
		$sequence_7 = { 83c40c 837d2010 8b450c 7303 8d450c 803c3839 7e64 }
		$sequence_8 = { 8b5d08 33c0 8945f0 c703???????? c74360d4534500 8945fc 8b03 }
		$sequence_9 = { e8???????? 68???????? 8d858cfdffff 50 c7858cfdffffc0544500 e8???????? 8d8d30feffff }

	condition:
		7 of them and filesize < 964608
}