MALPEDIA_Win_Bandook_Auto

rule MALPEDIA_Win_Bandook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2411d708-642e-57d7-a6bf-2bdb78b552df"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandook"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.bandook_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "0d15f4bfa38ad4643428b43f0275e1498f715d2e6cf5d275eaf798dc57c9b780"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a08 8d4dd4 e8???????? 8b75b8 8b7db4 8b55b0 8bc6 }
		$sequence_1 = { 68???????? 8d85fcfdffff 68???????? 50 e8???????? 83c410 8d85fcfdffff }
		$sequence_2 = { e8???????? 83c404 8d95f4fdffff b902000080 56 e8???????? 8b9decfbffff }
		$sequence_3 = { 0fb6c1 c1e908 894c2414 331f 8b04c592bb1e13 334704 c1e908 }
		$sequence_4 = { 51 e8???????? 83c408 c645fc1d 8b5580 c78534ffffff00000000 c78538ffffff0f000000 }
		$sequence_5 = { 8a4e04 884f08 8b4e08 894f0c c682f900000000 }
		$sequence_6 = { d9c9 d9f1 833d????????00 0f859c110000 8d0d10131d13 ba1a000000 e9???????? }
		$sequence_7 = { c645fc06 8d4f04 c703???????? c74304???????? c7431c54ab1d13 897b08 }
		$sequence_8 = { 68???????? 50 e8???????? 83c414 8d442410 6a00 }
		$sequence_9 = { c6041f00 85db 7431 297dfc 0f1f00 ff75f8 ff15???????? }

	condition:
		7 of them and filesize < 23088128
}