MALPEDIA_Win_Pterois_Auto

rule MALPEDIA_Win_Pterois_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "910461f2-a3e6-50bc-a626-f723a8c8ae53"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pterois"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.pterois_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "b7ce2a8f8845eb7fbdf4556f57ab206b63751b7511422612a4dd9df00e0607df"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ba1f9e5797 e8???????? 488905???????? 488b0d???????? ba524aaa5b e8???????? 488905???????? }
		$sequence_1 = { 33c9 4c8d057c180100 488d154d6a0100 e8???????? 4885c0 7415 49ba7030525e472705d3 }
		$sequence_2 = { 83c0d0 83e80a 0f8229000000 e9???????? }
		$sequence_3 = { 75dd 488d055b500100 483bd8 74d1 488bcb e8???????? ebc7 }
		$sequence_4 = { bafbdc7061 e8???????? 488905???????? 488b0d???????? bafa6fbeac e8???????? 488905???????? }
		$sequence_5 = { 488b442438 48833800 0f8411000000 488b4c2438 488b442438 488b00 48894808 }
		$sequence_6 = { 4883ec48 4889542438 48894c2430 48c744242800000000 48837c243000 0f850e000000 48c744244000000000 }
		$sequence_7 = { 4889442438 488b442440 488b00 4889442440 e9???????? 48837c244800 0f8422000000 }
		$sequence_8 = { e9???????? 48837c247000 0f860e000000 488b442470 4883e801 4889442460 e9???????? }
		$sequence_9 = { 488b442430 488b4820 488b442430 48894838 488b442430 48c7402000000000 48837c244800 }

	condition:
		7 of them and filesize < 528384
}