MALPEDIA_Win_Underminer_Ek_Auto

rule MALPEDIA_Win_Underminer_Ek_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "478c25cf-e188-5b79-8aeb-6935a8b536f7"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.underminer_ek"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.underminer_ek_auto.yar#L1-L178"
		license_url = "N/A"
		logic_hash = "4786465e315c0c23f824b89be267cb511060061f2cde5a1665c6404f963bc60b"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8a450f 884708 0fb6450b 89470c e9???????? 3cc8 }
		$sequence_1 = { 3d40420f00 734f 83ec18 8bcc 68???????? e8???????? 8d4dc8 }
		$sequence_2 = { 8904bd582c4300 85c0 7514 6a0c 5e 8975e4 c745fcfeffffff }
		$sequence_3 = { c3 ff742408 8b442408 ff10 c3 }
		$sequence_4 = { 897df8 6681384d5a 0f85bd000000 8b703c 03f0 }
		$sequence_5 = { 6a00 50 ff5604 8d460c 6a00 50 ff16 }
		$sequence_6 = { 0fb6560b c1e008 0bc2 8be8 8d470c 3bc8 7278 }
		$sequence_7 = { 8b75c8 8d4de0 ff75d8 8b55f0 83ff10 0f43c6 }
		$sequence_8 = { 47 884607 897df4 c745f04a50fa7e eb18 3ca0 7214 }
		$sequence_9 = { 8d45e0 50 8d8d08ffffff e8???????? 8b55f4 83fa10 }
		$sequence_10 = { 3bd8 3be2 3bf3 3bf8 }
		$sequence_11 = { 7473 3bc3 c7450c32000000 7538 8b35???????? bf1453fa7e }
		$sequence_12 = { c7431000000000 8d5101 c743140f000000 c60300 0f1f8000000000 8a01 }
		$sequence_13 = { 8b450c 0fb684c848914200 c1e804 c9 c20800 8bff }
		$sequence_14 = { 3836 42 3653 3658 }
		$sequence_15 = { 03c8 3b4de8 7751 395de0 7440 83c00d 50 }

	condition:
		7 of them and filesize < 466944
}