MALPEDIA_Win_Voidoor_Auto

rule MALPEDIA_Win_Voidoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aba8a76a-42a2-5ac4-9441-bb1b2a2bc429"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.voidoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.voidoor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "7b72e80b0081ca865f1c4112c1672273998fb9973e7c23910bfeb94d886f20ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c784246803000001010101 c784246c03000001010101 c784247003000001010101 c784247403000001010101 c784247803000001010101 c784247c03000001010101 c784248003000001010101 }
		$sequence_1 = { c78580feffff45000000 c78584feffff45000000 c78588feffff45000000 c7459831313131 c7459c31313131 c745a031313131 c745a431313131 }
		$sequence_2 = { e8???????? 83c42c 85c0 75a2 56 ff15???????? 57 }
		$sequence_3 = { c6450c00 720b ff7524 e8???????? 83c404 8ac3 8b4df4 }
		$sequence_4 = { 660fd64008 e8???????? 83c420 52 50 68???????? 57 }
		$sequence_5 = { c785c4feffff31313131 c785c8feffff31313131 c785ccfeffff31313131 c785d0feffff31313100 e8???????? 83c404 8bc1 }
		$sequence_6 = { c645fc0f e8???????? 83c404 c645fc11 83bd1ceeffff10 720e ffb508eeffff }
		$sequence_7 = { ffb42410050000 8d8424a8020000 55 68???????? 6858020000 50 83c305 }
		$sequence_8 = { b815000000 0f44f0 ff742418 ff15???????? ff742424 ff15???????? 83c408 }
		$sequence_9 = { 33c0 e9???????? c7872811000001000000 8b464c 85c0 7411 50 }

	condition:
		7 of them and filesize < 1744896
}