MALPEDIA_Win_Cicada3301_Auto

rule MALPEDIA_Win_Cicada3301_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f61ae320-9d9a-50b0-b111-80302728896c"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cicada3301"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.cicada3301_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "7fd7553441050010b234608d074a06e5ba5c4250e4845be3d86d81d102460ad6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f30fbcd2 4801ca 4821fa 41807c150000 0f88ecfeffff 66410f6f4500 660fd7c8 }
		$sequence_1 = { e8???????? 85c0 0f84d9090000 4c89e1 e8???????? e9???????? 4c89742448 }
		$sequence_2 = { e8???????? 4889f9 4889f2 4989d8 e8???????? eb7b 0f10842490040000 }
		$sequence_3 = { f3440f6f0438 66410f6fc0 660f74c7 66440fd7f0 4585f6 7533 66440f74c6 }
		$sequence_4 = { f390 83c1f8 75eb 83e005 74ab 660f1f440000 f390 }
		$sequence_5 = { bad0010000 480f44d7 41b808000000 e8???????? 488b9660010000 4889d8 4889f1 }
		$sequence_6 = { f3420f6f0c0f f3410f6f10 660f6fda 660f60d8 660f70db4e f20f70db1b f30f70db1b }
		$sequence_7 = { f3410f7e10 660f60d0 660f70d24e f20f70d21b f30f70d21b 660f67d2 660fd61413 }
		$sequence_8 = { f3450f58c0 f3440f5ec6 f3440f59c1 f3440f5cc7 ffc1 0f28f9 410f28c8 }
		$sequence_9 = { e9???????? 89f0 31d2 41f7f6 4885d2 741e bf02000000 }

	condition:
		7 of them and filesize < 11247616
}