MALPEDIA_Win_Rm3_Auto

rule MALPEDIA_Win_Rm3_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "55974a73-f2ee-57f4-9fb2-9af114dc90d9"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rm3"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rm3_auto.yar#L1-L372"
		license_url = "N/A"
		logic_hash = "1bed90ec4522c70ac09c22db83604c066c1ea6e59d91187470276c98decc4f24"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 23d0 8b460c 03c2 394508 }
		$sequence_1 = { 8b4138 8b5608 8d5410ff 48 f7d0 23d0 }
		$sequence_2 = { 8d5418ff eb0a 8b4138 8b5608 }
		$sequence_3 = { 8b00 51 03c2 50 e8???????? 83c40c }
		$sequence_4 = { 03c8 0fb74106 8365f800 53 }
		$sequence_5 = { 23fa 3bf8 7609 8b413c }
		$sequence_6 = { 8d740818 8b4508 3b460c 7247 }
		$sequence_7 = { 7505 3945fc 759f 5f 5e }
		$sequence_8 = { 8db5f0feffff 8bce 8d041b 51 8945f8 e8???????? 57 }
		$sequence_9 = { 41 ff4508 ff4d0c 885405fc 40 83f803 7ce4 }
		$sequence_10 = { 83c704 83c604 837dfc00 75de 8d85f0feffff 50 }
		$sequence_11 = { 50 8db4b558feffff 894510 56 8bc3 }
		$sequence_12 = { 56 ff7510 8d8df4feffff 51 }
		$sequence_13 = { 57 8bc3 8d8d58feffff e8???????? }
		$sequence_14 = { 8bcb 8d9568ffffff 8bc6 e8???????? ebd2 }
		$sequence_15 = { 50 e8???????? ff7518 8d85f0feffff ff750c 8d8d6cfeffff }
		$sequence_16 = { e8???????? 483bc3 488bf8 7416 }
		$sequence_17 = { eb8c ff15???????? 8bd8 4885ff 7412 488b0d???????? 4c8bc7 }
		$sequence_18 = { 8803 4883c601 4883c301 4883ef01 75a0 }
		$sequence_19 = { 754f 8d5001 8d480f e8???????? }
		$sequence_20 = { 448be0 7476 4c8d6e78 498bcd e8???????? 488b4c2460 488b6e20 }
		$sequence_21 = { 83e802 85c0 7e20 488d4c243c 8b01 4183c001 4883c104 }
		$sequence_22 = { 488bf9 488d4c2450 498bd8 ff15???????? 4c8b1b 8364242800 4c015c2450 }
		$sequence_23 = { e8???????? f7d0 31470c 488b0d???????? 4c8bc3 33d2 ff15???????? }
		$sequence_24 = { 01ce 83f900 0f44f2 8b0e 83f900 }
		$sequence_25 = { 894dec 8955e8 8975e4 8945e0 0f84f2000000 8b45f0 }
		$sequence_26 = { 56 8985d0fbffff 8995ccfbffff 898dc8fbffff ffd7 83f800 }
		$sequence_27 = { a1???????? 8b8de0fbffff 51 ffd0 8b0d???????? 8b95e4fbffff }
		$sequence_28 = { 89c7 01f7 83c6c0 81fec00f0000 8945f4 894df0 }
		$sequence_29 = { 8b8d60ffffff 83c101 8b954cffffff 83c228 8b75ac }
		$sequence_30 = { 89b504ffffff e8???????? 8b854cffffff 890424 }
		$sequence_31 = { c7424418180000 c7424800a00100 8b7de4 c787cc00000000000000 c787c800000000000000 }
		$sequence_32 = { e8???????? 8d0db2318702 890424 894c2404 }
		$sequence_33 = { 89442404 e8???????? 83c408 c785ecfbffff00000000 8d8decfbffff 8b15???????? }
		$sequence_34 = { 891c24 89442404 c744240800000000 8954240c 8b4590 894d80 }
		$sequence_35 = { 80fa00 8945f4 894df0 742f 8b45f4 8b4df0 8945ec }
		$sequence_36 = { 894da4 8945a0 0f855affffff b801000000 8b4db0 8b11 }
		$sequence_37 = { 6a50 68???????? 50 8985e8fbffff ffd1 8b0d???????? }
		$sequence_38 = { 8b8d6cffffff 894c2404 898558ffffff e8???????? 83c408 b901000000 }
		$sequence_39 = { b901000000 8d956cfdffff 891424 c74424040d000000 c744240801000000 }

	condition:
		7 of them and filesize < 221184
}