MALPEDIA_Win_Tidepool_Auto

rule MALPEDIA_Win_Tidepool_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dd2e5f28-abfd-58a8-a2a8-ea28faa244be"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tidepool"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.tidepool_auto.yar#L1-L262"
		license_url = "N/A"
		logic_hash = "aa178d415beb9c4997246c9f1636848425691dbac0fb28e937331daca515c23b"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a00 50 8b08 ff91a4000000 }
		$sequence_1 = { 5b 8b8d00030000 33cd e8???????? 81c504030000 }
		$sequence_2 = { 5e c20400 80790800 c701???????? 740e 8b4904 85c9 }
		$sequence_3 = { e8???????? 83c404 8bc6 5e c20400 80790800 }
		$sequence_4 = { 64890d00000000 59 5f 5e 5b 8b8d00030000 }
		$sequence_5 = { 33db 53 6a02 8bf1 e8???????? }
		$sequence_6 = { 51 83c006 50 6a02 }
		$sequence_7 = { 2bc8 83e906 51 83c006 }
		$sequence_8 = { e8???????? 83c40c 803d????????37 7518 68???????? }
		$sequence_9 = { 6800000040 8d4500 50 ff15???????? }
		$sequence_10 = { 8b08 ff91a4000000 8b4654 6a01 50 }
		$sequence_11 = { 6810270000 ff15???????? 8b45ec 8b08 }
		$sequence_12 = { 52 50 8b08 ff91f8000000 }
		$sequence_13 = { 83ff14 7509 8b4654 50 }
		$sequence_14 = { 740c 8b470c 83c604 833c0600 }
		$sequence_15 = { 741d 6a00 68b80b0000 ffd3 }
		$sequence_16 = { 8bf1 e8???????? 8b4654 6a00 50 }
		$sequence_17 = { e8???????? 68???????? 68???????? 68???????? 8d4500 }
		$sequence_18 = { 49 75f9 b8???????? b900000400 }
		$sequence_19 = { 681f000200 56 68???????? 6801000080 }
		$sequence_20 = { eb06 8b3d???????? 8d45fc 50 }
		$sequence_21 = { 8d0c40 8d148500000000 89442414 894c2410 89542418 8b5500 }
		$sequence_22 = { ff75ec ff15???????? 8b35???????? 6a04 }
		$sequence_23 = { 8d85b8fcffff 89bdb8fcffff 50 ffd6 8d45e8 }
		$sequence_24 = { ff15???????? 8d45a4 50 ffd6 8d55b4 }
		$sequence_25 = { e8???????? 83c414 a3???????? ff35???????? 56 8b35???????? }
		$sequence_26 = { 0f85d1000000 807c19ff20 8d4419ff 7504 802000 4b 57 }
		$sequence_27 = { 741b ff75f8 e8???????? 84c0 59 }
		$sequence_28 = { d1e1 51 50 ff75fc e8???????? 83c414 }

	condition:
		7 of them and filesize < 1998848
}