MALPEDIA_Win_Splitloader_Auto

rule MALPEDIA_Win_Splitloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "921d3356-2722-53ac-8250-dd0cc7ea5e5b"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.splitloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.splitloader_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "d6a390b70948f794f39be9da944fc8149cfb46ac0abcc61ba408624052ca713e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 418b8424f82a0000 4129b424fc2a0000 297518 01751c 418b8c24fc2a0000 03c6 }
		$sequence_1 = { ffc2 4183f802 7514 81fa04010000 730c 4885c9 }
		$sequence_2 = { 4883c108 48ffcb 7409 488b05???????? ebe6 4533c0 488d1593970000 }
		$sequence_3 = { ff15???????? 85c0 7445 4863ef 488d0dfcb20000 }
		$sequence_4 = { 4883c002 66443918 74f6 0fb708 85c9 7467 }
		$sequence_5 = { 7436 90 66413bc1 742f }
		$sequence_6 = { 488b442470 4c2bdb 4c8918 41f6c209 0f8432010000 4585e4 0f8829010000 }
		$sequence_7 = { ff15???????? 448b5c2440 41bc08000000 8bd6 458bd4 448bce }
		$sequence_8 = { eb0a 4883c002 41ba22000000 0fb708 6683f922 7438 90 }
		$sequence_9 = { 6644391f 750e 0f1f4000 4883c702 }

	condition:
		7 of them and filesize < 174080
}