MALPEDIA_Win_Unidentified_115_Auto

rule MALPEDIA_Win_Unidentified_115_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3f57197c-2a0e-5c2f-91b4-2a6584aed0f1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_115"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.unidentified_115_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "f34d16f4fb1756d871f8b8d2b98778ba2d274726c5e8a4c97d5758d2a5b7da7f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e9???????? 4c8d6c242c baf4010000 4c89e9 e8???????? 31c9 }
		$sequence_1 = { 4889cb 4889d1 4989d4 e8???????? 4889c6 4885c0 7505 }
		$sequence_2 = { 4431e5 4189c4 4401dd 4189d3 01eb 89d5 41c1cb0b }
		$sequence_3 = { 4989c6 488b05???????? 4d8b7e18 498906 488d0531650100 49894610 }
		$sequence_4 = { 498907 4c89442448 e8???????? 4c8b442448 49894718 4d85c0 7408 }
		$sequence_5 = { 31d2 e8???????? 4898 48898424d8020000 4885c0 7511 488b4c2438 }
		$sequence_6 = { 488b8c24b8000000 e8???????? e9???????? 488b0d???????? ba30000000 e8???????? 4989c4 }
		$sequence_7 = { 488b0d???????? ba30000000 4c8d35a9b70100 e8???????? b941000000 4989c5 488b05???????? }
		$sequence_8 = { 4c8b0e 488bb424d0010000 488b7c2430 488b4e38 4c8d4710 4889542420 488b542438 }
		$sequence_9 = { e8???????? 49c7450800000000 4c8d0d67410100 4c89e9 4c8d0568410100 48c7442420ed000000 }

	condition:
		7 of them and filesize < 648192
}