MALPEDIA_Win_Zardoor_Auto

rule MALPEDIA_Win_Zardoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1e92978b-4a0b-544e-8ff4-2c32e212f8b1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zardoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.zardoor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e7b04bc720af6c18148a76af65f5a9bdd071392f16a184f59447036aba92cea0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb13 4489542450 eb0c 448954244c eb05 4489542448 448b542428 }
		$sequence_1 = { 741e 4533c0 4c8d4c2438 418d5025 e8???????? 83cbff 83f801 }
		$sequence_2 = { e8???????? 48894348 4885c0 7542 4c8d0db6bf0c00 c744242055000000 baf5000000 }
		$sequence_3 = { e8???????? 488b4c2448 e8???????? 4c8b6c2458 488bc7 4c8b642460 488b6c2468 }
		$sequence_4 = { e8???????? 85c0 0f8e95010000 4c8d053f710e00 488bcb 488d15e3150b00 e8???????? }
		$sequence_5 = { 660f73d908 66490f7ec9 4983f902 0f824b010000 4c8b442460 4983e902 410fb64001 }
		$sequence_6 = { 8b842490000000 488b742478 41396d38 0f8501010000 85c0 0f84f9000000 488b8c2480000000 }
		$sequence_7 = { 7709 493bd1 0f83a2000000 483bd9 7709 493bd3 0f8394000000 }
		$sequence_8 = { e8???????? 85c0 0f9fc3 e9???????? 4c8d0d361c1100 448bc6 488bcd }
		$sequence_9 = { e8???????? 4c8bc7 488d15649e1000 b902000000 e8???????? 83c8ff e9???????? }

	condition:
		7 of them and filesize < 4376576
}