MALPEDIA_Win_Photoloader_Auto

rule MALPEDIA_Win_Photoloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6c751be1-c2cb-5243-adb8-0d3b0ee080b0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.photoloader_auto.yar#L1-L178"
		license_url = "N/A"
		logic_hash = "4ef9abae65ee48675c18344bccc98eacf875c4cac6a37cb56292b6b1626aa103"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 25ffffff00 0d00000005 e9???????? 8bd7 397b1c 7640 }
		$sequence_1 = { f7411400000020 7407 8b41f8 3901 }
		$sequence_2 = { 0fa2 894704 33c9 b800000040 }
		$sequence_3 = { 33c9 b800000040 0fa2 895f0c }
		$sequence_4 = { 33ff 8bf7 8d6f10 ff15???????? 0f31 }
		$sequence_5 = { c0c003 0fb6c8 8bc1 83e10f }
		$sequence_6 = { e8???????? 85c0 7512 ff15???????? 25ffffff00 0d00000003 }
		$sequence_7 = { 7417 448bc2 0f31 48c1e220 480bc2 }
		$sequence_8 = { 4c03da 4585c0 7420 498d4b10 f7411400000020 }
		$sequence_9 = { 488bcd ffd0 ff15???????? 25ffffff00 }
		$sequence_10 = { 7512 ff15???????? 25ffffff00 0d00000007 eb4a 397b1c 7629 }
		$sequence_11 = { 55 33ed c744241804000000 56 }
		$sequence_12 = { 7461 8d4c2410 51 8d4c2424 51 53 }
		$sequence_13 = { 89742414 eb1b 8d4101 89742414 89442410 8d4601 }
		$sequence_14 = { 759a 50 51 53 55 }
		$sequence_15 = { 03f8 8d0c7b e8???????? 03f8 }
		$sequence_16 = { 8bf9 33f6 33c9 0fa2 894500 }
		$sequence_17 = { 7504 8907 8bf0 8d6c2410 33c9 b801000080 }

	condition:
		7 of them and filesize < 107520
}