MALPEDIA_Win_Avcrypt_Auto

rule MALPEDIA_Win_Avcrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "43b84f09-1b5d-50e6-aaa6-ed2245c22ea0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avcrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.avcrypt_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "72ee95635b57f552cfa51bb0200ba397da957a30f2c8df0690d43c12220d0d09"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 59 5e c3 b8ffff0000 c20400 33c0 33d2 }
		$sequence_1 = { 53 8bce c706???????? e8???????? 8bc7 }
		$sequence_2 = { ff75f0 ff15???????? 85c0 790b 8b45f0 50 }
		$sequence_3 = { 8b02 eb02 8bc2 3bc8 7413 83e902 ebb6 }
		$sequence_4 = { 50 e8???????? 59 85c0 7456 837d1c08 }
		$sequence_5 = { ff15???????? 85c0 7507 68???????? ffd6 895de4 837dd000 }
		$sequence_6 = { 85c9 7408 8b85ccfdffff 8901 83460404 8d85c4fdffff }
		$sequence_7 = { 50 89742414 897c2418 c744241c20000000 ff15???????? 8b450c 48 }
		$sequence_8 = { c1e106 8b048580b54300 804c080420 8b4d14 8b75f8 ba000000c0 8bc6 }
		$sequence_9 = { 8bf1 8b4690 8d4ea0 8b4004 c7443090b4484300 8b4690 }

	condition:
		7 of them and filesize < 6160384
}