MALPEDIA_Win_Akira_Auto

rule MALPEDIA_Win_Akira_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c426bd5b-8805-5b66-8daf-ba1d072bce3f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akira"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.akira_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "c1aab8eddda1d3480074bed6d80c6e71287cefda313e66277925e225b843ef1f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb0f 48890f 8b45c7 894710 8b456f 894714 33c0 }
		$sequence_1 = { c3 4055 4883ec20 488bea b818010000 48038520010000 48898598000000 }
		$sequence_2 = { 4156 4883ec20 65488b042558000000 488bf9 b904000000 bd01000000 896a30 }
		$sequence_3 = { e9???????? 488d8a60120000 e9???????? 488d8a80120000 e9???????? 488d8aa0120000 e9???????? }
		$sequence_4 = { 8bc1 660f1f440000 48833cc200 7426 ffc1 48ffc0 4883f806 }
		$sequence_5 = { ff5020 88442430 0f57c0 0f11459f 48c745af01000000 41bf0f000000 4c897db7 }
		$sequence_6 = { 4533c0 488bd7 488d4dcf e8???????? 90 4c8d4dcf }
		$sequence_7 = { ffd2 90 488d55c7 488bce e8???????? 4533f6 4c3975e7 }
		$sequence_8 = { 75ab 0f2845bf 488b4d5f 0f1101 4c8d75cf 48837de710 }
		$sequence_9 = { e8???????? 8b0d???????? ff15???????? 4885c0 7423 488b4808 }

	condition:
		7 of them and filesize < 1286144
}