MALPEDIA_Win_Redalpha_Auto

rule MALPEDIA_Win_Redalpha_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cd9045d7-f87a-592e-9809-e5720f592d0f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redalpha"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.redalpha_auto.yar#L1-L295"
		license_url = "N/A"
		logic_hash = "f85fca11ddb3d7432dacaec7cca79704d6819401bb8debb1c4167507085bc80d"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 50 e8???????? 83c40c c0e304 0fb6c3 50 }
		$sequence_1 = { ba00010000 488d8d00010000 ff15???????? 488b8b38010000 }
		$sequence_2 = { 8b4508 be00100000 89475c 8b978c000000 }
		$sequence_3 = { 8b4508 c645fc06 85c0 753f 8d45e0 c745dcd4024300 }
		$sequence_4 = { 8b4508 c1ee04 33f1 033cb0 }
		$sequence_5 = { 8b4508 8d4dc4 53 8b5d10 }
		$sequence_6 = { 4889742420 57 4881ec30040000 33f6 }
		$sequence_7 = { 6690 39b42440040000 76b7 33d2 }
		$sequence_8 = { 803831 0f8539020000 83bc248800000058 0f852b020000 4885c9 750f }
		$sequence_9 = { 8b4508 898850030000 8b4508 59 c74048c8154400 }
		$sequence_10 = { 83cdff 488bd9 4c8bfa 458bc2 4c637014 }
		$sequence_11 = { 4155 4156 4157 8bb994000000 448bda 448b4944 }
		$sequence_12 = { 730d 488b03 83780800 0f855dfeffff 8b8b18170000 }
		$sequence_13 = { 488b0b ff15???????? 488b0b ff15???????? ffc7 }
		$sequence_14 = { 8b4508 8bc8 83e03f c1f906 6bc030 03048d30284400 }
		$sequence_15 = { 8b4508 8955fc 56 8bf1 57 bf01000000 85c0 }
		$sequence_16 = { 50 64892500000000 ff7108 c701???????? ff15???????? }
		$sequence_17 = { 8d1c3f 53 50 51 }
		$sequence_18 = { c645fc01 8d5102 668b01 83c102 6685c0 75f5 2bca }
		$sequence_19 = { 8d74242c 83c40c 33c9 8d5601 8a06 46 84c0 }
		$sequence_20 = { 8945f4 8b4514 40 c745ec33374000 894df8 8945fc 64a100000000 }
		$sequence_21 = { 68???????? 50 ffd7 8b5d08 8d85f4fbffff 8b35???????? }
		$sequence_22 = { 50 e8???????? 8d842480140000 c74424443c000000 }
		$sequence_23 = { c3 8bff 55 8bec 8b4d08 33c0 3b0cc5a8fc4000 }
		$sequence_24 = { ffd6 8b45a0 85c0 7403 50 ffd6 85ff }
		$sequence_25 = { 8b4308 2bc1 51 50 ff7658 8bce e8???????? }
		$sequence_26 = { 6800040000 894608 e8???????? 53 8b1d???????? }
		$sequence_27 = { ffd3 56 ffd3 ff742428 ffd3 8b8c246c180000 8bc7 }
		$sequence_28 = { e8???????? 84c0 7508 83ceff e9???????? 6a00 }
		$sequence_29 = { b9???????? c745fc00000000 8d5102 6690 }
		$sequence_30 = { c1e902 50 f3a5 8d8574ffffff }

	condition:
		7 of them and filesize < 606208
}