MALPEDIA_Win_Typeframe_Auto

rule MALPEDIA_Win_Typeframe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "54b5c61d-baac-5ee7-bf22-feb7211e94de"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typeframe"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.typeframe_auto.yar#L1-L148"
		license_url = "N/A"
		logic_hash = "80d5f324e45f06373a108fe4a18abca87604cdaaeb894c2ac4120a591e037164"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 004fb5 0500cccccc cc 48895c2410 }
		$sequence_1 = { 002d???????? b505 00eb b405 }
		$sequence_2 = { 004775 0300 3c75 0300 }
		$sequence_3 = { 0026 b505 004fb5 0500cccccc }
		$sequence_4 = { 006a0f 57 8bf0 e8???????? }
		$sequence_5 = { 0004af 0300 f6ae0300e8ae 0300 }
		$sequence_6 = { 01442468 8d4c0f78 83e978 8d44242c }
		$sequence_7 = { 0056e5 0400 af e504 }
		$sequence_8 = { 0102 0318 18040506071818 1818 }
		$sequence_9 = { 008601010000 0fb69601010000 410fb60c30 0fb60432 }
		$sequence_10 = { 0108 83c004 4a 75cd }
		$sequence_11 = { 014424fc 83ec04 2bc1 58 0f83be000000 }
		$sequence_12 = { 008501010000 410fb60c28 0fb69501010000 0fb6042a }
		$sequence_13 = { 01442408 c74424fc00000000 014c24fc 83ec04 }
		$sequence_14 = { 01442418 8d6c282c 83ed2c eb04 }
		$sequence_15 = { 014424fc 83ec04 2bc2 58 720c }

	condition:
		7 of them and filesize < 2125824
}