MALPEDIA_Win_Tokyox_Auto

rule MALPEDIA_Win_Tokyox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b462a8a0-f28a-5712-a990-5092edb8777f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tokyox"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.tokyox_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "bb3a8a4224c473eeac74ab6318474ce515ef18ff1b0ab86de8b1da62cb868436"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c78550ffffff44000000 51 33c0 c7857cffffff01010000 837df010 }
		$sequence_1 = { 50 ffd6 c7470400000000 8b07 85c0 0f8405feffff 50 }
		$sequence_2 = { 6a00 68e9fd0000 ff15???????? 894508 33db 40 b902000000 }
		$sequence_3 = { ff15???????? 83f8ff 7487 5f 5e }
		$sequence_4 = { 83f808 8975b0 8b45fc 0f43cb }
		$sequence_5 = { 50 894508 e8???????? 8b33 }
		$sequence_6 = { 8b451c 83c404 8b00 85c0 7428 50 e8???????? }
		$sequence_7 = { 33f6 0f57c0 6a20 53 }
		$sequence_8 = { 0f84a4010000 50 e9???????? 8b1d???????? 68fe010000 8d85ecfdffff }
		$sequence_9 = { 68fe010000 8d44244c 6a00 50 e8???????? 83c40c 8d442410 }

	condition:
		7 of them and filesize < 237568
}