MALPEDIA_Win_Unidentified_075_Auto

rule MALPEDIA_Win_Unidentified_075_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "147c0d53-aecb-5cae-ac7f-14d52d3c203f"
		date = "2023-07-11"
		modified = "2023-07-15"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_075"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.unidentified_075_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "10617fdfd534147bc5e0f7e922724e69d45c37af66d21f98c629fa1bac685120"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20230705"
		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
		malpedia_version = "20230715"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 83c40c 6808020000 8d95dcf6ffff 52 6a00 }
		$sequence_1 = { 8bc1 5e 5d c3 55 8bec ff15???????? }
		$sequence_2 = { 52 e8???????? 6a00 8d85ace6ffff 50 8d8dbceeffff 51 }
		$sequence_3 = { 83c40c 33c0 668985d4f4ffff 6806020000 }
		$sequence_4 = { 837d9400 740d 8b55fc c7821002000000000000 837df000 }
		$sequence_5 = { 52 ff15???????? 83c410 b853000000 66898550ffffff }
		$sequence_6 = { 33c0 668945d0 8d4dd4 51 }
		$sequence_7 = { 742c 8b4514 85c0 7421 }
		$sequence_8 = { 85c0 0f8431ffffff b901000000 85c9 0f8515ffffff }
		$sequence_9 = { 81eca4000000 894dfc c745f400000000 c745f800000000 }

	condition:
		7 of them and filesize < 393216
}