MALPEDIA_Win_Plead_Auto

rule MALPEDIA_Win_Plead_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7e9e1e58-39f7-59e5-b3a4-1b007bd3b49b"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plead"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.plead_auto.yar#L1-L235"
		license_url = "N/A"
		logic_hash = "472077a875ce718756c4b86321844910a5fcb198a9f726c61a5f321a6737bcb0"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 56 50 e8???????? 59 59 5e c20400 }
		$sequence_1 = { 0f31 90 0145fc ff75fc ff15???????? }
		$sequence_2 = { 8d4514 53 50 56 53 6a05 }
		$sequence_3 = { 40 50 6a01 ff15???????? 83c40c 85c0 }
		$sequence_4 = { e8???????? 817d14e8030000 53 56 57 }
		$sequence_5 = { c745fcf8ffffff 3bf7 750c 895dfc }
		$sequence_6 = { 83c40c 85c0 7504 33c0 eb09 56 }
		$sequence_7 = { 56 897d14 e8???????? 83c40c 8d4514 53 }
		$sequence_8 = { 49 85d2 8945fc 741c 8b4508 }
		$sequence_9 = { 3de8030000 760f 8d44241c 50 }
		$sequence_10 = { 51 ff15???????? 33c0 81c418020000 }
		$sequence_11 = { 8bcf 81e1ff000080 7908 49 }
		$sequence_12 = { 6a00 6a00 ff15???????? 6a02 a3???????? 8b8c242c020000 51 }
		$sequence_13 = { 49 8975fc 75ec 8bc6 5e }
		$sequence_14 = { 8bd8 b941000000 33c0 8dbddcfeffff }
		$sequence_15 = { 6a01 50 ff15???????? 50 ff15???????? 33c0 }
		$sequence_16 = { 648b1530000000 8b520c 8b521c 8b5a08 }
		$sequence_17 = { 6a04 8d45fc 50 6805100000 68ffff0000 57 ff9698000000 }
		$sequence_18 = { ebc4 8345fc14 8b5dfc e9???????? 33c0 }
		$sequence_19 = { b800010000 e8???????? 85c0 7477 50 8bf8 }
		$sequence_20 = { 80cc02 8b4b10 85c9 751a f6c240 7408 8b4dfc }
		$sequence_21 = { 6a08 ff563c 50 ff5620 c3 50 6a00 }
		$sequence_22 = { 50 8bf8 668b4514 668907 }
		$sequence_23 = { 85c0 0f84a7000000 03403c 85c0 0f849c000000 }

	condition:
		7 of them and filesize < 8224768
}