MALPEDIA_Win_Abaddon_Pos_Auto

rule MALPEDIA_Win_Abaddon_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "294c2b65-e107-5d8c-be1b-ff47ba55f6ac"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abaddon_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.abaddon_pos_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "9e191dc2956f1d2565e2e1157cf5e2ccf7eb989b4be397925fe4914fe25951e2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 750a 83fb3c 7605 e9???????? }
		$sequence_1 = { b804d00700 0faf45f4 03855cfeffff 6800d00700 50 }
		$sequence_2 = { 038560feffff 6a00 6a00 50 }
		$sequence_3 = { 4c 8b7d10 49 81c700040000 48 }
		$sequence_4 = { 81bea001000000dc0500 740c 81bea001000000d60600 7508 }
		$sequence_5 = { 89d9 ff15???????? 48 83c420 c704030d0a0000 48 }
		$sequence_6 = { 48 0500040000 803800 7664 48 31c9 48 }
		$sequence_7 = { 83c420 48 83c408 48 83ec30 48 c7c100000000 }
		$sequence_8 = { c786b801000000000000 c786bc01000000000000 807b0100 750c c786b001000001000000 eb0a c786b001000000000000 }
		$sequence_9 = { eba6 43 ebcd ffb5c8feffff }
		$sequence_10 = { ff15???????? 48 83c430 48 83ec20 48 89c1 }
		$sequence_11 = { 52 ff15???????? 0186a0010000 ff86a0010000 e9???????? 6a05 ff15???????? }
		$sequence_12 = { 81fb00010000 7607 b800010000 eb02 89d8 }
		$sequence_13 = { c786a801000000000000 fe86a8010000 42 80beb001000001 }
		$sequence_14 = { 7208 48 83f80c 7702 eb05 e9???????? 48 }

	condition:
		7 of them and filesize < 40960
}