MALPEDIA_Win_Common_Magic_Auto

rule MALPEDIA_Win_Common_Magic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0b8ec34f-64ef-5d8b-a9f9-cff72a12d1a9"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.common_magic"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.common_magic_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "57cdd1e579da97572bf4d420f494a264192cff56dd86f56812a8f1acb0926b5e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0f438d14ffffff 837f1408 7202 8b37 8b5710 }
		$sequence_1 = { 8b8d54ffffff 2bc1 c745dc43006c00 c745e065006100 c745e46e002e00 c745e865007800 c745ec65000000 }
		$sequence_2 = { 6bc938 8b048570804100 0fb6440828 83e040 5d c3 e8???????? }
		$sequence_3 = { 8a8750754100 08441619 42 0fb64101 }
		$sequence_4 = { 8d45c8 897dac b941000000 c745cc4f004700 }
		$sequence_5 = { c78598feffff07000000 66898584feffff 83f908 7235 8b95fcfeffff 8d0c4d02000000 }
		$sequence_6 = { 746e 8b4dfc 8d7823 8b55f8 83e7e0 8947fc eb19 }
		$sequence_7 = { 51 ffb580feffff 8d8d5cffffff e8???????? 838d78feffff06 8d8de4feffff 83bdf8feffff08 }
		$sequence_8 = { 668b040e 663b01 7517 83c102 83ea01 75ef 8b45e8 }
		$sequence_9 = { 8d8068754100 8945e4 803800 8bc8 7435 8a4101 84c0 }

	condition:
		7 of them and filesize < 212992
}