MALPEDIA_Win_Darkdew_Auto

rule MALPEDIA_Win_Darkdew_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f5713b05-d68d-5a96-8b8b-3746cbaf2177"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkdew"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.darkdew_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "11e20ec5dc70dfd13de9b6788add5450b8305995cd717588a944e82f9fc44478"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83e801 0f8595010000 c745e4545d0110 e9???????? 894de0 c745e4545d0110 }
		$sequence_1 = { 8d4d9c 0f43c8 83ff0b 754d ba???????? }
		$sequence_2 = { 50 ff15???????? 48 b991000000 f7d8 1bc0 697df844020000 }
		$sequence_3 = { 50 ff15???????? 837db010 8d459c 6a06 0f43459c 50 }
		$sequence_4 = { 83e13f c1f806 6bc938 8b0485a0f30110 0fb6440828 }
		$sequence_5 = { 2bc1 83f801 7218 8d4101 83fa10 8945c8 8d45b8 }
		$sequence_6 = { 84c0 75f9 2bca 83fe10 8d55dc 51 }
		$sequence_7 = { 0f8723010000 8d040a 8bcb 3bc3 }
		$sequence_8 = { e8???????? 83c40c 33c0 6689047e 8b7db4 eb18 }
		$sequence_9 = { 2bf9 8b8d5cffffff 8bc2 2bc1 }

	condition:
		7 of them and filesize < 279552
}