MALPEDIA_Win_Rikamanu_Auto

rule MALPEDIA_Win_Rikamanu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fa68f79b-ff53-513e-a7cc-3d1689f3ed1d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rikamanu"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rikamanu_auto.yar#L1-L301"
		license_url = "N/A"
		logic_hash = "bfd5ac9a751697f93978ed736ffc8cd489b9d0cd0c6135d299b074b527866109"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 50 ff15???????? 8b35???????? 3d80969800 }
		$sequence_1 = { e8???????? 6a14 ff15???????? a801 }
		$sequence_2 = { 8d942440060000 51 52 e8???????? 83c408 85c0 7524 }
		$sequence_3 = { 6a00 6a00 55 ffd7 bf???????? 83c9ff }
		$sequence_4 = { ff35???????? ffd7 56 e8???????? 59 5e }
		$sequence_5 = { 8d942434020000 83e103 53 f3a4 }
		$sequence_6 = { 8d4c2410 68???????? 51 c744241810724000 e8???????? }
		$sequence_7 = { 56 57 33f6 bf???????? 833cf57490240001 }
		$sequence_8 = { f3a5 8bca 83e103 f3a4 6a14 }
		$sequence_9 = { 8365fc00 8b049d383f4100 f644380401 740b 56 e8???????? 59 }
		$sequence_10 = { 50 6830040000 53 53 53 8d8df4fdffff 51 }
		$sequence_11 = { 52 891d???????? c705????????01000000 ffd6 8b4dfc 5e }
		$sequence_12 = { 7219 83f85a 7714 8088????????10 8ac8 80c120 8888a0a64000 }
		$sequence_13 = { 6880000000 83e103 6a04 f3a4 }
		$sequence_14 = { 0f841f020000 83c9ff bf???????? 33c0 68???????? f2ae f7d1 }
		$sequence_15 = { 33c0 c3 8bc8 83e01f c1f905 8b0c8de0b84000 8a44c104 }
		$sequence_16 = { e8???????? 59 8bcf 83e71f c1f905 c1e706 8b0c8d383f4100 }
		$sequence_17 = { 0f94c1 5e 890d???????? 5b c3 663d1100 7525 }
		$sequence_18 = { 53 50 e8???????? 68ff000000 8d85e9f9ffff }
		$sequence_19 = { 57 8dbdf4fdffff 2bc2 4f 8a4f01 47 }
		$sequence_20 = { 52 8b15???????? 50 51 81e2ffff0000 52 68???????? }
		$sequence_21 = { 33c5 8945fc 53 56 6a01 68???????? }
		$sequence_22 = { 8d85ecfbffff 68???????? 50 e8???????? 83c410 8d85ecfbffff }
		$sequence_23 = { 2bf9 8bf7 8bd1 83c9ff bf???????? }
		$sequence_24 = { a801 740a c705????????01000000 8b442414 8b4c2410 50 }
		$sequence_25 = { 837d0001 0f85f5030000 ff15???????? 8be8 8d842430010000 }
		$sequence_26 = { 898518e5ffff 8b8528e5ffff 8b0485383f4100 89853ce5ffff 397c0138 741c }
		$sequence_27 = { c705????????04000000 ffd6 e8???????? 8b15???????? 68???????? 52 891d???????? }
		$sequence_28 = { 8b85ccfdffff 6aff 50 ff15???????? 8b8df0fdffff 8b35???????? 51 }
		$sequence_29 = { 888808972400 40 ebe6 ff35???????? ff15???????? 85c0 }

	condition:
		7 of them and filesize < 212992
}