MALPEDIA_Win_Retro_Auto

rule MALPEDIA_Win_Retro_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "54b24fe9-9fd1-54c0-a395-935122df7bc0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.retro_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "599af0bfd5ee60a1ba65ef57ea0c1de02676fdbfc366b689801c1bd471d36af8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f20f59c2 f20f5c2dd713fcff f20f59da f20f580d9b14fcff f20f58056314fcff f20f582dbb13fcff f20f59da }
		$sequence_1 = { 488b442440 eb02 33c0 488b8c2470010000 4833cc e8???????? 4881c480010000 }
		$sequence_2 = { 0f284c2470 0f11443340 0f114c3350 89443360 83c364 83bfa000000000 740b }
		$sequence_3 = { f30f1025???????? 0f28ec f30f59e6 f3410f59ee f30f5829 f30f58642408 }
		$sequence_4 = { 41f7e4 d1ea 410f2ff0 f30f5844947c f30f1144947c 7626 450f2fc2 }
		$sequence_5 = { 75ba e9???????? 48636c2458 4533c9 4883f904 0f8c36010000 488d79fc }
		$sequence_6 = { 4c8d1d96660000 f30fe6cc f20f1015???????? f20f59d1 660f7ee1 48c7c03f000000 23c1 }
		$sequence_7 = { 0f28c3 f30f1049fc f30f58d0 f30f59c9 0f2fd9 f30f58e1 7703 }
		$sequence_8 = { 410bc8 410bc0 81c9c0000000 0fbae807 894af8 8942f4 4183f905 }
		$sequence_9 = { 48ffcb 75ee 488b9c2430010000 85f6 7e24 8bd6 }

	condition:
		7 of them and filesize < 1409024
}