MALPEDIA_Win_Moriya_Auto

rule MALPEDIA_Win_Moriya_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e86b1a3-5d2e-58a2-b6f3-ee6493a0eb7e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriya"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.moriya_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "4b2c346f1178ba9ce9d00f4fda666d39e5c4c2cec7acd5a1892705c7d51c3f70"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488d542460 488b0d???????? 4533c9 f30f7f45a0 4889442470 4533c0 0f1007 }
		$sequence_1 = { 488bcb 4889442448 f30f7f442428 e8???????? 8bd8 }
		$sequence_2 = { 8844242e e8???????? 488d442428 482bf0 }
		$sequence_3 = { 742a 488b4b08 4885c9 7406 ff15???????? }
		$sequence_4 = { 786d 488b0d???????? 33d2 e8???????? 8bd8 }
		$sequence_5 = { 4883ec38 488364242000 488bd1 4c8b0d???????? }
		$sequence_6 = { e8???????? 48833d????????00 7417 488d4dd0 ff15???????? 488b0d???????? ff15???????? }
		$sequence_7 = { 4883ec28 418b00 4c8bc9 448bd8 4c8bd1 }
		$sequence_8 = { 660f1f440000 4a895408f8 4983e908 75f5 4983e007 }
		$sequence_9 = { 0f57c0 488985b0000000 33d2 0f118590000000 448d4058 0f1185a0000000 e8???????? }

	condition:
		7 of them and filesize < 99328
}