MALPEDIA_Win_Xsplus_Auto

rule MALPEDIA_Win_Xsplus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3f0d7ffb-6d2b-54bb-93e8-b91caf3d74ed"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xsplus"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.xsplus_auto.yar#L1-L173"
		license_url = "N/A"
		logic_hash = "d1e503d1ee9e4435450731001eb709a9b8a9f116bfcacb3f4b0a409fd6faef6b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b761c 8b4608 8b7e20 8b36 66394f18 }
		$sequence_1 = { 39b810a84000 0f8491000000 ff45e4 83c030 }
		$sequence_2 = { 8945fc 837dfc00 7502 eb4c }
		$sequence_3 = { 8b8db4fdffff 81e9cd860100 898db4fdffff 83bdb4fdffff03 0f87c5000000 }
		$sequence_4 = { 83c201 8955f8 8b4514 8945f4 8b4df4 83c101 }
		$sequence_5 = { 8985e8fdffff 83bde8fdffff00 0f8c9d000000 8b5508 }
		$sequence_6 = { ff15???????? 83c408 85c0 7463 8b4d08 51 ff15???????? }
		$sequence_7 = { 8b4508 0345fc 8a08 880a c745f800000000 }
		$sequence_8 = { 8945f4 8b55fc 8b02 8b4dfc 51 ff5008 }
		$sequence_9 = { 8955e4 8b45e4 3b45d8 0f8d24010000 8b4de4 }
		$sequence_10 = { ff15???????? c745e0b4924000 c745dc58020000 8d55d4 52 6a00 6860100000 }
		$sequence_11 = { b801000000 e9???????? 6a00 ff15???????? b801000000 }
		$sequence_12 = { 8b55c8 52 e8???????? 83c408 85c0 0f85f8000000 }
		$sequence_13 = { 8b85a8feffff 898590feffff 8b8d90feffff 51 }
		$sequence_14 = { 8bec 81ec2c050000 57 c785f0fdffff04010000 }
		$sequence_15 = { c74668e0a34000 6a0d e8???????? 59 }
		$sequence_16 = { 8b5118 c1ea10 8b4508 8910 8be5 5d c20800 }

	condition:
		7 of them and filesize < 597872
}