MALPEDIA_Win_Pvzout_Auto

rule MALPEDIA_Win_Pvzout_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "03af0307-cabf-5ac8-8f15-270ed93c9948"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pvzout"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.pvzout_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "081a8c66d717fda0c1eae119a5af9854413daeff31e48b4b0a69e363cbed36d6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { d4a1 0e 75a8 43 }
		$sequence_1 = { 9c b3d7 5a bf95f6810e 75a8 43 }
		$sequence_2 = { 19e9 73f8 dca10ebd24e8 252b0026cb 9e }
		$sequence_3 = { 48 e21c 3e3f 19e9 }
		$sequence_4 = { 43 1dea50873a d4a1 0e }
		$sequence_5 = { 1dea50873a d4a1 0e 75a8 43 1dea50873a }
		$sequence_6 = { 1dea50873a d4a1 0e 75a8 }
		$sequence_7 = { ab 25b53ae778 f3bd95ab4ed8 fb }
		$sequence_8 = { 5d bbedffffff 03dd 81eb00d00200 83bd8804000000 899d88040000 0f85cb030000 }
		$sequence_9 = { e21c 3e3f 19e9 73f8 dca10ebd24e8 252b0026cb 9e }

	condition:
		7 of them and filesize < 573440
}