MALPEDIA_Win_Blindingcan_Auto

rule MALPEDIA_Win_Blindingcan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7fd302e7-fd2c-50df-b2a0-1a6d431c6b3a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.blindingcan_auto.yar#L1-L178"
		license_url = "N/A"
		logic_hash = "92e4319977551df3fd2ef0b0a9fbbd2aa0b1b91e8cddb3206851a2859f8eb343"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { dc1d???????? dfe0 f6c405 7bd5 }
		$sequence_1 = { a1???????? 33c5 8945f8 8b4508 db00 }
		$sequence_2 = { 750a 8b10 8994bdfcfdffff 47 }
		$sequence_3 = { c785f8fcffffe25fcedf c785fcfcfffff15112b2 c78500fdffffc2840aa6 c78504fdfffff79d6681 }
		$sequence_4 = { c7858cfeffffafe2e55a c78590feffff74c31dff c78594feffff657f9183 c78598feffffa78b5b05 c7859cfeffff87f53e0c c785a0feffff074f9b22 c785a4feffff7c7277e4 }
		$sequence_5 = { c745a453e8ba52 c745a8b67dbc8f c745ac3a39b69d c745b08c5fbadf c745b4e13300b2 }
		$sequence_6 = { c785c0feffff10d43c68 c785c4feffff7c9f1888 c785c8feffff1ce6ae9e c785ccfeffff64ceb0a1 c785d0feffff2d58cb71 c785d4feffff62c2f218 }
		$sequence_7 = { c78508ffffffdcb29bd9 c7850cffffff5e41f6d0 c78510ffffff75bb0656 c78514ffffff47cdfbc7 c78518ffffff79ecb859 }
		$sequence_8 = { f7fe 8bca e8???????? 85c0 7409 e8???????? 85c0 }
		$sequence_9 = { 48832300 4883c310 48ffce 75d4 488d1d9f0e0100 488b4bf8 4885c9 }
		$sequence_10 = { 45339c8c10c30100 45339c8410cb0100 418bc2 41c1ea10 45335d44 c1e818 0fb6d0 }
		$sequence_11 = { 4533848410cb0100 4533456c 418bc0 c1e810 0fb6d0 418bc1 418bb49410c30100 }
		$sequence_12 = { e8???????? 488d0dcfdb0100 448bc6 33d2 e8???????? 488bcb 33f6 }
		$sequence_13 = { 488b15???????? b918200000 4533c9 458bc4 e8???????? 33db 85c0 }
		$sequence_14 = { 4533e4 488bf9 448bc3 488d95f0030000 458d6c2401 498d80fefdff7f 4885c0 }
		$sequence_15 = { ff15???????? 83f802 0f8c9f020000 488bcf ff15???????? 83f804 0f8c8d020000 }

	condition:
		7 of them and filesize < 363520
}