MALPEDIA_Win_Soraya_Auto

rule MALPEDIA_Win_Soraya_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "14bbde5d-15cc-5025-8b24-26e133addab2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soraya"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.soraya_auto.yar#L1-L226"
		license_url = "N/A"
		logic_hash = "b2e9247a6dd1093d6971a6ef5da72b47d313966f90239a9370fea94dbcd381d2"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ff15???????? 8d48bf 80f919 77f2 }
		$sequence_1 = { 0301 8b4c2410 3901 0f87a1fdffff }
		$sequence_2 = { e8???????? 8b45fc 33c6 2bc3 50 }
		$sequence_3 = { ff15???????? 037df8 3975f8 75db 8b4514 33c9 }
		$sequence_4 = { ff4d3c 7580 8b451c 8b4d24 014dfc c745d03223f000 }
		$sequence_5 = { 8bec 51 51 837d1800 747b }
		$sequence_6 = { ff75ec e8???????? 8b4df0 8b45f4 8d440801 8945fc 8d45d8 }
		$sequence_7 = { 8b4508 8a08 884d0b 8a4d0b 8b55f8 0fb6c9 }
		$sequence_8 = { 8d85ecfdffff 50 ffd6 a1???????? 0540010000 50 8d85ecfdffff }
		$sequence_9 = { 8b4d0c 8b5520 33ce 8b8c118e40f2ff 8b10 8b18 }
		$sequence_10 = { 59 68???????? 53 ffd7 5b 85c0 }
		$sequence_11 = { ff15???????? 488b0d???????? 488364242000 488d5150 4c8d45d0 448bc8 }
		$sequence_12 = { 8b5254 48 f7d0 23d0 8b45f4 }
		$sequence_13 = { 488bcb ff15???????? 488d1563f0ffff 488bcf }
		$sequence_14 = { 744f ba0c000000 4c8d8c24b0020000 488bce 448d4234 }
		$sequence_15 = { 33c0 66390f 0f8515010000 8b4f3c 03cf 813950450000 }
		$sequence_16 = { 4533c0 488bd5 498bcf ff15???????? 498bce }
		$sequence_17 = { 488bd0 488bd8 ff15???????? 488d15d9f0ffff 488bcf ff15???????? }
		$sequence_18 = { 0fb6c0 2bcb 3bc1 0f8462010000 }
		$sequence_19 = { 8b4804 83e908 f7c1feffffff 763b 8b4dfc }
		$sequence_20 = { 8d740650 8b02 0306 8b742418 }
		$sequence_21 = { 4d2bc6 0fb701 6641398408a0010000 7530 ffc2 48ffc1 }
		$sequence_22 = { 4533c0 418d5064 ff15???????? 4883c430 5b }

	condition:
		7 of them and filesize < 188416
}