MALPEDIA_Win_Unidentified_098_Auto

rule MALPEDIA_Win_Unidentified_098_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c18aa87e-6608-590d-b3e6-6d59705994a8"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_098"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.unidentified_098_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "f4628b9d13189ec6d9ca2bc0fe1eb5e37f70ed32ec905431ab55d17bbf59580f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c4c1781150e8 4c8b49f8 4d8948f8 4839ca 75e1 4883ea18 48b9abaaaaaaaaaaaa0a }
		$sequence_1 = { e8???????? 488b7320 4c8b6318 4c39e6 742e 66662e0f1f840000000000 }
		$sequence_2 = { ff15???????? 0fb606 6683f808 0f85affeffff 48837e0800 0f85a4feffff 41b847490000 }
		$sequence_3 = { 4883c508 48d1ea 4d8d24d0 4989e8 4d29c8 4d39e1 7617 }
		$sequence_4 = { 8844242b 4189542414 498b542440 493b542448 0f85c8fbffff 4989f0 4889d9 }
		$sequence_5 = { 7449 8802 48ff4340 8b4314 83f80a 750c }
		$sequence_6 = { 664539d1 7ce8 49ffc4 418808 4c39e6 75bd 488b13 }
		$sequence_7 = { 488d47ff 4489ca 664539c8 7d18 885001 4889c1 66440fbe48ff }
		$sequence_8 = { 7fa0 4881ff00000080 7c06 89f8 85c0 7991 48837b1800 }
		$sequence_9 = { 4c8949f0 4c8b48d8 4c8949e8 4939f8 7591 4c29ef }

	condition:
		7 of them and filesize < 3345408
}