MALPEDIA_Win_Brambul_Auto

rule MALPEDIA_Win_Brambul_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b876c689-d83b-5dec-b921-bfe452e3308e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brambul"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.brambul_auto.yar#L1-L166"
		license_url = "N/A"
		logic_hash = "10ed389e06d32ea2cb75b4e9c1e8e63ca5a2399f331b65c0200a902b07d067b2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 730d 8d8d887fffff 2bc1 48 }
		$sequence_1 = { 83c40c 83f8ff 0f840d020000 a0???????? 3c34 7404 }
		$sequence_2 = { 68???????? 55 e8???????? 83c40c 83f8ff 0f8488010000 6800040000 }
		$sequence_3 = { 8bd7 33d1 035054 8d9c13f87ca21f 8bd3 c1ea10 }
		$sequence_4 = { 894d08 85c9 0fb64a01 0f8429010000 d3ee }
		$sequence_5 = { 8bb4247c010000 b980000000 8d5624 c6460873 8bfa f3ab }
		$sequence_6 = { 8dbc37604bbbf6 8bf7 c1ee10 c1e710 0bf7 }
		$sequence_7 = { 33c9 8a4e01 8bf9 8d5703 }
		$sequence_8 = { 8d942474010000 57 52 8bf0 ff15???????? }
		$sequence_9 = { 56 57 ff15???????? 8b7c2420 8b5c241c }
		$sequence_10 = { 8d95887fffff 8dbd887fffff 3bd0 730d }
		$sequence_11 = { 2bdf 2bcb 395df8 7612 295df8 8a11 }
		$sequence_12 = { 66898dc0f5ffff 8d8dc4fdffff 8955dc 8945e0 51 8d9598e3ffff 68???????? }
		$sequence_13 = { 8d85887fffff 2bd0 8955fc 837dfc00 }
		$sequence_14 = { 8d542464 c744246400020000 52 f3a5 e8???????? }
		$sequence_15 = { 8b442424 8b4c2428 8d9d28030000 6804010000 53 }

	condition:
		7 of them and filesize < 188416
}