MALPEDIA_Win_Pss_Auto

rule MALPEDIA_Win_Pss_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fbbb2815-94c8-561e-94c6-498d07321f32"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pss"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.pss_auto.yar#L1-L140"
		license_url = "N/A"
		logic_hash = "1bf8fcdb627b9f8c2470bed889f91c7321c8e9a7ea36557fd1df759ed4db903f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8d48fe e8???????? e9???????? 83f811 }
		$sequence_1 = { ff15???????? 83ceff 3bc6 7504 }
		$sequence_2 = { 7437 ff15???????? 3de5030000 752a }
		$sequence_3 = { 53 56 bb???????? 53 8bf1 }
		$sequence_4 = { eb07 c74004???????? 5e 5d c20800 6a04 }
		$sequence_5 = { b8ffdb0000 663bd0 77dc 3bf3 743c 0fb70e }
		$sequence_6 = { 833900 7405 e8???????? 68???????? ff15???????? }
		$sequence_7 = { 803e00 7539 68???????? ba00010000 8bcb e8???????? c745c402000000 }
		$sequence_8 = { 33c9 418d6801 8bd5 ff15???????? }
		$sequence_9 = { 418d5101 ff15???????? 488905???????? 4885c0 0f84e7020000 }
		$sequence_10 = { 48f7e7 480f40c3 488bc8 e8???????? 4183c9ff 4d8bc7 }
		$sequence_11 = { 0f84ba000000 4883cbff 4c63ff 4d03fe 498bd7 488d4c2478 }
		$sequence_12 = { 488bd0 488d0d496a0100 e8???????? 90 48837c244008 }

	condition:
		7 of them and filesize < 421888
}