MALPEDIA_Win_Manjusaka_Auto

rule MALPEDIA_Win_Manjusaka_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "99e97e96-c1f4-5f8c-921c-ea1c667365b3"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manjusaka"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.manjusaka_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d8cae82d339b95840df9e2ce574a6b8a1874ec3caad45b349183588726f1dd67"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { b802000000 f0490fb10e 488d4c2428 e8???????? 90 4883c448 5b }
		$sequence_1 = { 84c0 745a 488b4f70 4c8bc7 488b17 4883c108 e8???????? }
		$sequence_2 = { e9???????? 488b8c24e8030000 488b9424d8030000 e8???????? 488b442448 4c8ba858010000 488bb060010000 }
		$sequence_3 = { 84c0 410f95c1 488d5c2428 4889d9 4c89ea 41b812000000 e8???????? }
		$sequence_4 = { 7204 4d8b40f8 488b0d???????? 31d2 e8???????? 488b4b58 488b4360 }
		$sequence_5 = { eb0f b9741a0100 e9???????? 4a8b5cfd60 0fb74318 0fb64b0c 03c2 }
		$sequence_6 = { e8???????? 4885d2 7415 4c39e8 7509 4c39e2 0f846a010000 }
		$sequence_7 = { 8bf0 8b5b54 23de 83fb11 0f8520010000 418bc7 4503fd }
		$sequence_8 = { 84db 7805 49ffc4 eb6e 89d9 83e11f 410fb6742401 }
		$sequence_9 = { fec0 884322 e9???????? 8d4d01 48897308 894b28 488bc7 }

	condition:
		7 of them and filesize < 4772864
}