MALPEDIA_Win_Purplefox_Auto

rule MALPEDIA_Win_Purplefox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "34a46ea5-c31f-5a3e-bf06-a3099f772a6d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplefox"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.purplefox_auto.yar#L1-L388"
		license_url = "N/A"
		logic_hash = "b161dd636f1f60dd3dea9e5aea74e9bbfb20d047d3e6bea34d6bf5b7c6f3077a"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8d4f40 660fbae50c 0fb3c7 660fbec2 8d04ed539f9b01 29d1 }
		$sequence_1 = { 8bf0 8b4dfc ff15???????? 56 68???????? ffd3 83c408 }
		$sequence_2 = { a3???????? a1???????? c705????????bb454000 8935???????? a3???????? ff15???????? a3???????? }
		$sequence_3 = { 410bc0 488d542458 488d0d5fef0000 8905???????? 488d05baa00000 }
		$sequence_4 = { 8b742428 66f7d5 8b6c242c 9c 9c 68af6a40e4 }
		$sequence_5 = { 8b11 8d45f4 50 8b45f8 6a00 }
		$sequence_6 = { 8b4dfc c70700000000 8b07 33cd 5e }
		$sequence_7 = { 458bcc 4c8bc6 33d2 4889442420 ff15???????? 8bf8 }
		$sequence_8 = { 48895d1f 4889752f 48897537 ff15???????? 8bd8 85c0 }
		$sequence_9 = { 8b5604 83c40c 8d8d7cffffff 51 52 ff15???????? }
		$sequence_10 = { 59 59 8b7508 8d34f518fc4000 391e }
		$sequence_11 = { 448bc6 442bc0 488b442450 488d0d697d0000 488b0cc1 }
		$sequence_12 = { 5d c3 56 a3???????? 8d45f8 50 51 }
		$sequence_13 = { c20400 6800040000 8d95acfbffff 53 52 }
		$sequence_14 = { 4889442458 4889442460 4889442468 e8???????? 488d8d80010000 448bc7 33d2 }
		$sequence_15 = { d1d1 cf 4d 7961 24c2 3a3b ea???????????? }
		$sequence_16 = { a3???????? bd79c7c7fd dbd1 25346acfea }
		$sequence_17 = { ffc0 49ffc0 83f850 7ce2 eb10 418b4805 }
		$sequence_18 = { 4883ec20 488bd9 e8???????? 4c8d1d17a10000 }
		$sequence_19 = { 3d31040000 7415 50 68???????? e8???????? 83c408 33ff }
		$sequence_20 = { 488bd8 4885c0 751c 488b4d6f }
		$sequence_21 = { 488bd9 4885c0 7479 488d0d6f960000 483bc1 746d }
		$sequence_22 = { 8b07 83c404 8d5002 8d642400 668b08 }
		$sequence_23 = { ff15???????? 8bf8 85c0 786d ba58000000 33c9 }
		$sequence_24 = { 8bf0 c1fe05 c1e106 030cb5000c4100 eb02 8bca }
		$sequence_25 = { f5 c1c002 85e2 e9???????? }
		$sequence_26 = { 4883c440 5b c3 448b4310 8bd0 488bcb e8???????? }
		$sequence_27 = { 8b55d8 52 ffd6 33c0 5f 5e }
		$sequence_28 = { 1052f1 89550b 01c7 55 51 1dd3cb602e 357f437332 }
		$sequence_29 = { 68???????? 6a00 52 56 }
		$sequence_30 = { c744246800010000 4889742460 89742458 89742450 4889742448 c744244020000000 c744243801000000 }
		$sequence_31 = { c1f805 8bf7 83e61f c1e606 033485000c4100 c745e401000000 33db }
		$sequence_32 = { 48894a38 33d2 488bc8 ff15???????? }
		$sequence_33 = { 8b3d???????? 03d9 8d4900 8b4304 83e808 d1e8 8d5308 }
		$sequence_34 = { 85c0 0f850a010000 488b8eb8000000 4c8d25038d0000 f0ff09 7511 }
		$sequence_35 = { 55 2d0a08766e 6abd 80e96b 60 }
		$sequence_36 = { 488d0d97210000 4c8be2 48897810 ff15???????? 498b8c24b8000000 448b6908 8b4918 }
		$sequence_37 = { 33c0 6808020000 50 89442420 89442424 8944242c 89442430 }
		$sequence_38 = { 896c243c 660fcf 68e6ef209f 6687cb 0f98c3 8774243c 53 }
		$sequence_39 = { 4803c3 eb02 33c0 488d154bb00000 488bc8 e8???????? }

	condition:
		7 of them and filesize < 1983488
}