MALPEDIA_Win_Scoring_Math_Tea_Auto

rule MALPEDIA_Win_Scoring_Math_Tea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "72a68397-1150-5c5e-aa19-a6f46beacfd1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scoring_math_tea"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.scoring_math_tea_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "a0b7afbb01f83e4c72fd10ca97627b81d25ffa4f2a282f6522fc2dc5dd107ff6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4903cf 66443921 75f7 8b05???????? 488d542430 8901 0fb705???????? }
		$sequence_1 = { 4885c0 74d1 488d4c2460 ffd0 b9ad2d0ca2 e8???????? 488d4c2448 }
		$sequence_2 = { 4c8d8520030000 4c89642428 8bd7 488bce 4c89642420 c744246005010000 ff15???????? }
		$sequence_3 = { 740d 418bcf e8???????? 488bce ffd0 418bc6 488b4d27 }
		$sequence_4 = { 4881f900100000 7215 e8???????? 488bf8 eb19 493bc8 0f87c2000000 }
		$sequence_5 = { 4c8d4c2450 488364242000 448bc7 ff15???????? 8b442450 eb09 c7431400000001 }
		$sequence_6 = { 7423 8b5c2440 488bd5 015f5c 448bc3 8b4f60 e8???????? }
		$sequence_7 = { 420fb744f204 8987e8af0600 420fb744f206 8987dcaf0600 443bf5 7f07 66834e0404 }
		$sequence_8 = { 44886591 e8???????? 488d5587 488bcf 4c8bf8 e8???????? 4c8bf0 }
		$sequence_9 = { e8???????? c70022000000 e8???????? 488b8328090000 488db338090000 8bc8 }

	condition:
		7 of them and filesize < 881664
}