MALPEDIA_Win_Pipemon_Auto

rule MALPEDIA_Win_Pipemon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "57703f36-b066-5bf1-aaf8-6d75b0f37b8f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemon"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.pipemon_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "3d352e4f6a1c43361acce172d46166f6c8a25abf0d03914db928ce944bd4b157"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488bc2 488d0d1d450100 48890b 488d5308 }
		$sequence_1 = { c745b038020000 488d55b0 488bc8 ff15???????? 85c0 7440 }
		$sequence_2 = { 4839b938010000 7516 488d05f3370100 4a8b04e8 42387c3039 }
		$sequence_3 = { 0f1f00 8d4601 25ff000080 7d09 ffc8 0d00ffffff }
		$sequence_4 = { 4c8d0d349b0000 f20f5cca f2410f590cc1 660f28d1 660f28c1 4c8d0dfb8a0000 }
		$sequence_5 = { 488b18 483bd8 0f84f7010000 448b4320 488d15e4fb0100 }
		$sequence_6 = { 48894310 33c9 e8???????? 48894318 c6432000 b910000000 e8???????? }
		$sequence_7 = { 4983c302 6685db 0f856cffffff 4c89642428 }
		$sequence_8 = { 5b c3 4883ec38 488d05f5960000 41b91b000000 4889442420 e8???????? }
		$sequence_9 = { 4489a500020000 488d442460 488985f8010000 ba01000000 488d4c2460 }

	condition:
		7 of them and filesize < 389120
}