MALPEDIA_Win_Rorschach_Auto

rule MALPEDIA_Win_Rorschach_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b906f634-06f7-511a-9b2f-eef594dc2174"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rorschach"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rorschach_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "5f24ac102f398836ad45a544526cfb2eb2cc4eaf86f712be52f0b9204d2e2167"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488d8424b8000000 482bc3 4c89b42428010000 4889442430 4c8db4249c000000 4c89bc2420010000 488d8424bc000000 }
		$sequence_1 = { 888571010000 33d2 488d8d60010000 e8???????? 888572010000 b272 488d8d60010000 }
		$sequence_2 = { 488d8d70050000 e8???????? 888501060000 33d2 488d8d70050000 e8???????? 888502060000 }
		$sequence_3 = { 33d2 488d8d300b0000 e8???????? 8885580d0000 b23c 488d8d300b0000 e8???????? }
		$sequence_4 = { 90 4d8bc4 488bd0 498bcf e8???????? 488d85d8080000 488985b80c0000 }
		$sequence_5 = { 488d8da8010000 e8???????? 8885ab010000 33d2 488d8da8010000 e8???????? 8885ac010000 }
		$sequence_6 = { f781c8100000e0ffffff 762c 660f1f840000000000 428b0482 42898481a4100000 41ffc0 8b81c8100000 }
		$sequence_7 = { 488d8d300b0000 e8???????? 8885950c0000 33d2 488d8d300b0000 e8???????? 8885960c0000 }
		$sequence_8 = { e9???????? 488d8a58040000 e9???????? 488d8af8030000 e9???????? 488d8a38050000 e9???????? }
		$sequence_9 = { 90 498d542420 4903d7 488d8dc0000000 e8???????? 90 4c8d85e0000000 }

	condition:
		7 of them and filesize < 3921930
}