MALPEDIA_Win_Warmcookie_Auto

rule MALPEDIA_Win_Warmcookie_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ec89ed75-43ef-5e93-903d-d3f8383c90e1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warmcookie"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.warmcookie_auto.yar#L1-L228"
		license_url = "N/A"
		logic_hash = "dade3f49f004a30a420737451cd7da729d7cda1285499c65a4f74cd9aeafbe8d"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0f8709060000 4183fe03 0f87ff050000 4585f6 0f850a020000 }
		$sequence_1 = { 85c0 0f88c0060000 8d0480 8d4441d0 418902 0fb74502 }
		$sequence_2 = { 8944242c 48b8fffffffffdffffff 4889842480000000 31c0 6689842488000000 0fb706 897c2478 }
		$sequence_3 = { 41b902000000 41b800000000 ba00000000 4889c1 }
		$sequence_4 = { 48c744243000000000 c744242880000000 c744242003000000 41b900000000 41b807000000 ba00000080 4889c1 }
		$sequence_5 = { 0f8e1bffffff 01d0 89430c e9???????? 4157 }
		$sequence_6 = { 415c c3 55 4157 4156 4155 4154 }
		$sequence_7 = { ba19000000 488b4c2438 ff15???????? 85c0 }
		$sequence_8 = { 4883ec28 e8???????? 3dff2f0000 0f97c0 0fb6c0 }
		$sequence_9 = { 85c0 7409 488b442428 48c1e814 }
		$sequence_10 = { 488d4c0301 4801c9 e8???????? 4889c3 4885c0 }
		$sequence_11 = { ba18000000 4889c1 ffd3 85c0 }
		$sequence_12 = { 488b01 ff9080000000 85c0 7815 }
		$sequence_13 = { ff15???????? 25ff0f0000 8d88b80b0000 ff15???????? }
		$sequence_14 = { ff5010 b9e8030000 ff15???????? 83ef01 }
		$sequence_15 = { 4b8d1c00 4889d9 e8???????? 4989d8 488944f500 }
		$sequence_16 = { 488905???????? 448b06 4585c0 7416 b80a000000 }
		$sequence_17 = { 488d542470 b901010000 ff15???????? 85c0 }
		$sequence_18 = { 750b 488b4c2460 488b01 ff5068 488b4c2468 }
		$sequence_19 = { 6642894c0c20 ffc2 4f8d0c00 410fb70c19 6685c9 75d8 4863c2 }
		$sequence_20 = { ff15???????? b906000000 ba04000000 85c0 }
		$sequence_21 = { 1bc9 41d1e8 81e12083b8ed 4133c8 8bc1 2401 }
		$sequence_22 = { 83e2fc 83c224 89542450 83c2fc }
		$sequence_23 = { 488bcf e8???????? 488b6c2460 488bce e8???????? 488b7c2468 8bc3 }

	condition:
		7 of them and filesize < 331776
}