MALPEDIA_Win_7Ev3N_Auto

rule MALPEDIA_Win_7Ev3N_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3907c549-d041-5de8-8230-42e446fd2be2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.7ev3n"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.7ev3n_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "9b1cec25991aa76acf3290f27738c6cabf019f382df7a9f2fac1318754b8e765"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 66898560fbffff f30f7e05???????? 660fd68560feffff 0fb705???????? 66898568feffff f30f7e05???????? 660fd6854cfbffff }
		$sequence_1 = { 660fd685c0f3ffff 0fb705???????? 668985c8f3ffff f30f7e05???????? 660fd685b4f3ffff 0fb705???????? 668985bcf3ffff }
		$sequence_2 = { 2bcf 3bc1 0f8412490000 8dbdcce7ffff 8d4f02 0f1f840000000000 668b07 }
		$sequence_3 = { 50 8d8dd0cdffff e8???????? 8bce 2b8de8caffff 3bc1 0f848e040000 }
		$sequence_4 = { 0fb78100084500 8d4902 6689440dda 6685c0 75ec eb5e }
		$sequence_5 = { 6a00 8d8518e7ffff 50 8d8dd0cdffff e8???????? 8bce 2bcf }
		$sequence_6 = { 75de 33c0 eb05 1bc0 83c801 85c0 0f84b0fdffff }
		$sequence_7 = { 660fd68570fbffff 0fb705???????? 66898578fbffff f30f7e05???????? 660fd68570ddffff a1???????? 898578ddffff }
		$sequence_8 = { f30f7e05???????? 660fd68564e6ffff 0fb705???????? 6689856ce6ffff f30f7e05???????? 660fd68558e6ffff 0fb705???????? }
		$sequence_9 = { ff15???????? b902000000 e8???????? be01000000 85c0 740d 8d4e01 }

	condition:
		7 of them and filesize < 803840
}