MALPEDIA_Win_Nighthawk_Auto

rule MALPEDIA_Win_Nighthawk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1ea956b0-be8c-5890-911a-c393aa58e8a5"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nighthawk"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.nighthawk_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "4b751c3e5abba245cd70e3ad89ca9e58ef5b2ca9415a570dd8fcbbbd6942fa59"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 740e 83e901 7412 83f901 0f858b000000 f6838000000010 eb07 }
		$sequence_1 = { e8???????? 90 48897597 488975a7 4c896daf 41b81d000000 488d15d3020800 }
		$sequence_2 = { 7211 488b8d40080000 4885c9 7405 e8???????? 4889b550080000 4889bd58080000 }
		$sequence_3 = { 4c89642448 6644897c2430 e8???????? 4c8d442430 488b5320 e8???????? 85c0 }
		$sequence_4 = { 4c2bc7 4803d7 488d8c2430010000 e8???????? 90 4c3ba424a0000000 744f }
		$sequence_5 = { e8???????? 85c0 0f8517010000 80fb2c 0f840e010000 80fb5d 0f8405010000 }
		$sequence_6 = { 90 83ff03 0f85d1040000 8bfb 488b5c2440 488d4c2430 48837c244808 }
		$sequence_7 = { c3 e8???????? 90 cc 4883ec28 488b09 4885c9 }
		$sequence_8 = { 4c896e20 6644897e08 4883c660 488d4ec8 483bcd 0f856affffff 488b5c2450 }
		$sequence_9 = { 743f 0fb7d9 81cb00000780 85c9 0f4ed9 eb2f 488b8de8000000 }

	condition:
		7 of them and filesize < 1949696
}