MALPEDIA_Win_Red_Gambler_Auto

rule MALPEDIA_Win_Red_Gambler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c38fda1-b74b-574d-add9-dee69bde611a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.red_gambler"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.red_gambler_auto.yar#L1-L307"
		license_url = "N/A"
		logic_hash = "5abed0927198f5cce444594dd3f5b5b4ad949953e75cf8beeb7be8f4c6529b91"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 52 50 ff15???????? 3975fc 761e 8d5f30 }
		$sequence_1 = { 6a00 885604 8b45e8 50 6a05 56 }
		$sequence_2 = { ff15???????? 85c0 7549 68ff000000 8d8df0fcffff 51 ff15???????? }
		$sequence_3 = { ff15???????? 8bd8 85db 0f845c010000 68???????? 8bfb e8???????? }
		$sequence_4 = { 53 8bd8 a1???????? 56 57 8945e8 }
		$sequence_5 = { 56 8b35???????? 57 68???????? c745ece80f13fc ffd6 }
		$sequence_6 = { 85c0 7414 8b400c 8b4004 8903 894304 }
		$sequence_7 = { 7519 6a0a ffd6 68???????? 8bfb e8???????? 8bf8 }
		$sequence_8 = { c1c010 86c4 29f8 01f0 ab ebe3 }
		$sequence_9 = { 52 68???????? 6a00 6a00 ff15???????? 8b4dfc 33cd }
		$sequence_10 = { 627627 4f 8d74c79e cf 23530e }
		$sequence_11 = { 6800010000 8d85fcfeffff 50 6a00 ff15???????? }
		$sequence_12 = { 6a00 6a00 8d9598fbffff 52 68???????? 6a00 }
		$sequence_13 = { 7061 2dc7dc1667 3663ea 7c0e }
		$sequence_14 = { 6800010000 8d8d98fdffff 51 8d9598feffff }
		$sequence_15 = { 8d5598 52 8d8598fdffff 50 68???????? 8d8d98fbffff 68???????? }
		$sequence_16 = { 09afba55a367 59 2f 74be 6f 665b }
		$sequence_17 = { f3281c14 0c00 e779 cf }
		$sequence_18 = { 3663ea 7c0e 07 642827 }
		$sequence_19 = { 8d8d98fbffff 68???????? 51 ff15???????? }
		$sequence_20 = { 51 8d9598feffff 52 ff15???????? 8d8594fbffff }
		$sequence_21 = { 8d8594fbffff 50 8d4d98 51 }
		$sequence_22 = { 51 ff15???????? 83c414 6a00 6a00 }
		$sequence_23 = { e17a 6c 8737 27 97 }
		$sequence_24 = { 75f7 8b07 66c1e808 c1c010 86c4 }
		$sequence_25 = { 6e 44 b11a dfaf4e71ac05 }
		$sequence_26 = { 4c 40 34f3 3ccf f3281c14 0c00 }
		$sequence_27 = { c1f805 c1e606 033485c0974000 8b45f8 8b00 8906 8b45fc }
		$sequence_28 = { 85f6 0f8492000000 8b1d???????? 68???????? }
		$sequence_29 = { 40 68???????? 50 ff15???????? 8d85fcfeffff 50 }
		$sequence_30 = { a1???????? a3???????? a1???????? c705????????6b214000 8935???????? a3???????? ff15???????? }
		$sequence_31 = { 8bff 55 8bec 33c0 8b4d08 3b0cc5d8694000 }

	condition:
		7 of them and filesize < 327680
}