MALPEDIA_Win_Tigerlite_Auto

rule MALPEDIA_Win_Tigerlite_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6542912a-20c4-5fea-bb22-19f999e30548"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tigerlite"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.tigerlite_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "b32a203b18e11ae8126ad3ad045d7c873462db9436fa3220f1aa5ced7c8fc82e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0fb6c0 eb17 81fa00010000 7313 8a8798894100 }
		$sequence_1 = { 89442420 ff15???????? 4885c0 0f84cb010000 ba88130000 488bc8 ff15???????? }
		$sequence_2 = { 8d85e9fdffff c685e8fdffff00 6a00 50 e8???????? 6807020000 }
		$sequence_3 = { c1f905 c1e706 8b0c8d489d4100 c644390400 85f6 740c }
		$sequence_4 = { 488905???????? 488d0517410000 48890d???????? 488905???????? 488d058a410000 488905???????? 488d057c350000 }
		$sequence_5 = { 48894610 4c8bc3 48894618 e8???????? }
		$sequence_6 = { 48ffc3 803c1e00 75f7 e9???????? }
		$sequence_7 = { 488d8d91000000 33d2 41b8ff030000 c6859000000000 e8???????? 488d1502c10100 }
		$sequence_8 = { 3b1d???????? 7370 488bc3 488bfb 48c1ff05 4c8d2570790100 83e01f }
		$sequence_9 = { c1e106 83c10c 8b0485489d4100 03c1 50 ff15???????? 5d }
		$sequence_10 = { 6a10 8d85d0f1ffff 50 56 }
		$sequence_11 = { 488bc8 ff15???????? 488d1508ad0000 488bcb 488905???????? ff15???????? }
		$sequence_12 = { 83c404 56 ff15???????? b864000000 5f }
		$sequence_13 = { 4803c8 0fb601 884414ff 448809 48ffcf 75bb }
		$sequence_14 = { 6a01 6a02 668985eaf7ffff ff15???????? 8bf0 }
		$sequence_15 = { 75f3 53 e8???????? 56 e8???????? 57 e8???????? }

	condition:
		7 of them and filesize < 349184
}