MALPEDIA_Win_Sappycache_Auto

rule MALPEDIA_Win_Sappycache_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40e5397b-f9d2-5d39-9f00-00f93e2394d6"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.sappycache_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "e297a368e2ceb4e7a200380f3ff8cb73a2cf4cfaf9a62384f9af2e6b9941450c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f6c101 7412 b9c1000000 ff15???????? 33c0 e9???????? 410fb74614 }
		$sequence_1 = { 7509 418b4e38 f6c101 7412 b9c1000000 ff15???????? 33c0 }
		$sequence_2 = { 8bea 0f1f8000000000 e8???????? 448bf0 }
		$sequence_3 = { 488bcf ff15???????? 33c0 488bac2480000000 488b5c2478 488bbc2488000000 488b4c2450 }
		$sequence_4 = { 33db 4c8bfa 4c8be1 4883fa40 7312 b90d000000 }
		$sequence_5 = { 33d2 488d4d40 41b800010000 e8???????? 33d2 488d8d40010000 41b800010000 }
		$sequence_6 = { e9???????? 4d3bc1 0f84a3000000 8b7500 498b9cf720860100 4885db 7407 }
		$sequence_7 = { 754c 488d15131a0100 498bcc ff15???????? 488d15631a0100 488d0d4c610100 ff15???????? }
		$sequence_8 = { 482be0 488b05???????? 4833c4 48898520620000 4c89442468 }
		$sequence_9 = { 488d05133c0100 ffcb 488d0c9b 488d0cc8 ff15???????? ff0d???????? 85db }

	condition:
		7 of them and filesize < 262144
}