MALPEDIA_Win_Smanager_Auto

rule MALPEDIA_Win_Smanager_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a9ebb4a2-279e-50dd-8bbd-faa840ca945d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.smanager_auto.yar#L1-L226"
		license_url = "N/A"
		logic_hash = "829bd82c08b6a011f083c5676e02374652bacf1f1d2e6aef291985901b89a342"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c7462cffffffff 7410 6a00 6a00 }
		$sequence_1 = { 740e 3d45270000 7407 3d46270000 }
		$sequence_2 = { 8b4510 85c0 7407 50 ff15???????? 5f }
		$sequence_3 = { 8b4608 85c0 7420 a801 }
		$sequence_4 = { 8b7604 6a00 6a00 56 }
		$sequence_5 = { 7409 6a02 51 51 ffd0 83c40c c7460800000000 }
		$sequence_6 = { 83c602 6a22 56 e8???????? 83c408 }
		$sequence_7 = { 6a00 6a00 ff15???????? 8bf8 897e28 }
		$sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
		$sequence_9 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
		$sequence_10 = { 48894c2430 443b4120 7305 4889542430 488d442430 }
		$sequence_11 = { 0001 ce 50 0008 }
		$sequence_12 = { 0008 53 4f 00ef }
		$sequence_13 = { 488b09 488bf2 4885c9 740a 488b01 ba01000000 ff10 }
		$sequence_14 = { 0003 b157 0000 0c0c }
		$sequence_15 = { 4889442460 488b4b08 4883c108 488d542430 e8???????? }
		$sequence_16 = { 4057 4883ec20 488d3ddb6e0100 48393d???????? 742b b90c000000 e8???????? }
		$sequence_17 = { 0007 b15a 00c4 b15a }
		$sequence_18 = { 4c89742420 ff15???????? 85c0 7444 8b16 4c8bc5 }
		$sequence_19 = { eb40 4c8d35757a0100 488b0d???????? e9???????? 4c8d35727a0100 488b0d???????? }
		$sequence_20 = { 0000 80ed4a 0044feff ff900100008c }
		$sequence_21 = { 0007 b15a 0007 b15a }
		$sequence_22 = { 0007 b15a 0089b05a0089 b05a }
		$sequence_23 = { 85c0 0f8470010000 488b442448 488d0d07600100 4c8d4c2460 488b0cc1 }

	condition:
		7 of them and filesize < 10013696
}