MALPEDIA_Win_Remexi_Auto

rule MALPEDIA_Win_Remexi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8633079-b621-5520-8ad7-535ada6d6eda"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remexi"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.remexi_auto.yar#L1-L269"
		license_url = "N/A"
		logic_hash = "a9e8da1b3a009686668e2d3e1da19dafc09f7beeddc307847ba66c59fe4b8748"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 56 c706ffffffff e8???????? 83c404 }
		$sequence_1 = { 50 ff15???????? 8b0d???????? 8b35???????? 890d???????? }
		$sequence_2 = { ff15???????? 6a10 8d4ddc 8bf0 51 56 ff15???????? }
		$sequence_3 = { 41 50 a3???????? c705????????02000000 890d???????? ffd6 }
		$sequence_4 = { e8???????? 83ec1c 8bcc 89642430 6aff 53 }
		$sequence_5 = { 8945e8 b802000000 51 668945dc }
		$sequence_6 = { 8b45d8 8b4818 8b5104 50 8955e0 }
		$sequence_7 = { 8907 894704 894708 6a01 89470c }
		$sequence_8 = { ff15???????? 8bf0 85f6 7513 8b45d8 }
		$sequence_9 = { 53 50 ff15???????? 3dffffff00 }
		$sequence_10 = { 53 83cbff 57 8b3d???????? }
		$sequence_11 = { c705????????ffffffff c705????????01000000 c705????????00000000 ffd6 83ffff 7407 }
		$sequence_12 = { 8945e0 8945e4 8945e8 b802000000 }
		$sequence_13 = { 014b30 bf???????? b903000000 8b742418 }
		$sequence_14 = { 488d058da00100 c3 4053 4883ec20 488bd9 488d0d7ca00100 483bd9 }
		$sequence_15 = { 015330 41 894b0c e9???????? }
		$sequence_16 = { 015330 e9???????? 8b5314 3b5318 0f8d23020000 }
		$sequence_17 = { 015930 3b542408 0f8d10ffffff 8d3c52 }
		$sequence_18 = { 488b8c24a0000000 e8???????? 48c78424b80000000f000000 4c89bc24b0000000 c68424a000000000 }
		$sequence_19 = { 488b4c2470 e8???????? 48c78424880000000f000000 48c784248000000000000000 c644247000 41b806000000 488d151b3d0200 }
		$sequence_20 = { 016b04 83c41c 5b 5e }
		$sequence_21 = { 488d15c7780200 480f45d0 881f 381a 740e 4883cbff 90 }
		$sequence_22 = { 015518 8b5d14 85db 0f8565fbffff }
		$sequence_23 = { 488b09 488d41ff 4883f8fd 7714 ff15???????? 85c0 750a }
		$sequence_24 = { 015330 8a10 eb84 8a5001 }
		$sequence_25 = { 7532 b902010209 e8???????? 90 48837b1810 7208 }
		$sequence_26 = { 438d0401 4c8d1d31490100 418bca 99 2bc2 }
		$sequence_27 = { 016b24 89e8 83c44c 5b }
		$sequence_28 = { 488b01 8a08 880a 33c9 488d1c32 4c8d05c71a0100 }

	condition:
		7 of them and filesize < 614400
}