MALPEDIA_Win_Tinynuke_Auto

rule MALPEDIA_Win_Tinynuke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "be3f3308-f3c9-557b-ac2f-03d1f80231c1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinynuke"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.tinynuke_auto.yar#L1-L280"
		license_url = "N/A"
		logic_hash = "09cd6a4560e87039ad2e5d4645c08ca1af989c447e7d88147d0663fa6070fc94"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c3 55 8bec 817d0c00040000 }
		$sequence_1 = { 8d8530f6ffff 50 6802020000 ff15???????? }
		$sequence_2 = { ff7508 ff15???????? 53 8bf0 8d45fc 50 ff750c }
		$sequence_3 = { 8945f4 8d85d4feffff 50 ff15???????? }
		$sequence_4 = { 51 53 56 57 8d45fc 50 bb3f000f00 }
		$sequence_5 = { ff15???????? 8bc3 5b 5f 5d c3 55 }
		$sequence_6 = { 85c0 7526 56 8d45f8 50 56 }
		$sequence_7 = { 50 ff15???????? ff35???????? 8d85a4feffff 50 ff15???????? }
		$sequence_8 = { ff75ec ff75fc e8???????? 83c40c 5f }
		$sequence_9 = { ff15???????? a3???????? ff35???????? ff75f8 ff15???????? }
		$sequence_10 = { 6a2a 50 8945fc ff15???????? }
		$sequence_11 = { 8a00 3c0a 7409 3c0d }
		$sequence_12 = { a3???????? 68e2010000 68???????? 68???????? }
		$sequence_13 = { e8???????? eb18 83f803 7519 }
		$sequence_14 = { a3???????? ff35???????? ff75ec ff15???????? }
		$sequence_15 = { 59 50 68???????? 68???????? ff15???????? }
		$sequence_16 = { ff75fc 8d85f0fdffff 50 e8???????? 59 50 }
		$sequence_17 = { 8d7de0 f3ab 8d45dc 50 ff15???????? 8d85d0fcffff 50 }
		$sequence_18 = { ff15???????? 8b35???????? 8d430c 50 }
		$sequence_19 = { 83c404 85c0 0f847c010000 5f 5e 5b }
		$sequence_20 = { 7ee1 31db 8b049d1410e26e 85c0 7402 ffd0 }
		$sequence_21 = { 8d50f8 d1ea 7432 8d4608 }
		$sequence_22 = { 8344241814 8b442418 8b400c 85c0 75a4 }
		$sequence_23 = { eb5d 8b54240c 81fa80000000 7c0e 0fba25????????01 0f82de1f0000 }
		$sequence_24 = { 61 8b8decfeffff 8b95e8feffff 038dd0feffff }
		$sequence_25 = { 89442418 8b400c 85c0 745c }
		$sequence_26 = { 8bb0a0000000 2b6834 01de 8b16 85d2 7449 8b4604 }
		$sequence_27 = { 837c243401 7537 c744241400000000 c744241000000000 c744240c00000000 c7442408???????? }
		$sequence_28 = { 0f48c2 83c704 83c504 89442404 e8???????? 8945fc 8b0f }
		$sequence_29 = { 732e 8b5304 b904000000 8d820000e06e }

	condition:
		7 of them and filesize < 1196032
}