MALPEDIA_Win_Sphijacker_Auto

rule MALPEDIA_Win_Sphijacker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "077eac03-f3ac-5e2b-a96b-7f5530f41d45"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sphijacker"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.sphijacker_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "99b2b9f410e1eea51f0fdbb2a2e5758813b393a388e6990a38118e63ac79cf3a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 33db 488d154de60100 4533c0 488d0c9b 488d0cca baa00f0000 e8???????? }
		$sequence_1 = { 4885c9 741c 488d05208b0000 483bc8 7410 b801000000 f00fc1815c010000 }
		$sequence_2 = { 488d159ee00100 ff15???????? 488b4d20 488d4510 c744242804000000 }
		$sequence_3 = { 488d8d16120000 0f1005???????? 898510120000 33d2 0fb705???????? 41b8f2010000 }
		$sequence_4 = { 6666660f1f840000000000 803099 488d4004 4883e901 75f3 }
		$sequence_5 = { 488d4510 c744242804000000 488d158fdb0100 41b904000000 4889442420 }
		$sequence_6 = { 4533db 488d3d6b340000 4d85c9 488bc2 4c8be2 }
		$sequence_7 = { 488b4d18 4c8d4520 488d158ee30100 ff15???????? 488b4d20 }
		$sequence_8 = { 8b442430 8bc8 cd29 488d0d765e0100 e8???????? 488b442428 }
		$sequence_9 = { 57 4883ec20 418bf0 4c8d0d2b320100 8bda 4c8d051a320100 488bf9 }

	condition:
		7 of them and filesize < 808960
}