MALPEDIA_Win_Spedear_Auto

rule MALPEDIA_Win_Spedear_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bc74395a-f867-5375-b1a4-3194ab3faef7"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spedear"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.spedear_auto.yar#L1-L258"
		license_url = "N/A"
		logic_hash = "8ad71d71fef6d799b3c4103e4255891e4d1c676677fc2e42c68cbbb5bc612621"
		score = 75
		quality = 71
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 99 83e207 03c2 c1f803 83c40c }
		$sequence_1 = { 8b4718 8a5f06 50 894608 }
		$sequence_2 = { 53 50 e8???????? 8b7e0c 895e10 }
		$sequence_3 = { 83c408 c20800 51 53 }
		$sequence_4 = { 83fe12 7cd7 8d754c bb04000000 bf80000000 }
		$sequence_5 = { 5f 8b4c2428 33cc e8???????? 83c42c c20800 56 }
		$sequence_6 = { 6a00 68???????? e8???????? 83c40c 68d0070000 }
		$sequence_7 = { 0fb6d9 894c2414 0fb6e8 c1e808 8bc8 }
		$sequence_8 = { 894618 ffd7 89461c 5f }
		$sequence_9 = { 8b4718 894608 8b4f1c 51 e8???????? 894604 }
		$sequence_10 = { ff7608 ff5604 6800800000 6a00 }
		$sequence_11 = { 8bc7 5e 5f 5b 5d c3 6a08 }
		$sequence_12 = { 833e00 741a 6a00 6a00 ff7608 }
		$sequence_13 = { 394878 7456 39487c 7451 }
		$sequence_14 = { 53 50 89b5d8fbffff e8???????? 8b3d???????? }
		$sequence_15 = { 6a00 50 8906 e8???????? 83c410 c3 }
		$sequence_16 = { 83c8ff e9???????? 4c8bfb 4c8bf3 488d0540d30000 }
		$sequence_17 = { 4863d9 4c8be3 49c1fc05 4c8d2d56ab0000 83e31f }
		$sequence_18 = { 7cc1 034004 8b4804 8b10 03d1 }
		$sequence_19 = { 4889842480040000 488bd9 33ff 488d8c2471030000 }
		$sequence_20 = { 4c8d4c2440 488d542448 41b820000000 488bcf 48c744242000000000 ff15???????? }
		$sequence_21 = { 448ba088000000 488b4110 4c896c2410 4c89742408 468b74201c 468b6c2024 428b6c2020 }
		$sequence_22 = { 8b4d08 8945f0 8b450c 8945f4 8b4514 40 c745ec2dba2300 }
		$sequence_23 = { 89430c 8d4310 8d89bc182400 5a 668b31 668930 83c102 }
		$sequence_24 = { 0fb7444b10 6641898448b81c0100 ffc2 89542420 ebe2 8bd7 89542420 }
		$sequence_25 = { 480fbec5 420fbe8c0870b30000 83e10f eb03 }
		$sequence_26 = { b964000000 ff15???????? 48ffc3 4883ef01 75db }

	condition:
		7 of them and filesize < 188416
}