MALPEDIA_Win_Puzzlemaker_Auto

rule MALPEDIA_Win_Puzzlemaker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0b409857-ba16-52f8-86a4-f03b4c20bcd6"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.puzzlemaker"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.puzzlemaker_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "0ccc3e98278c1b00c53a3ce232e13d909a5b06ff70a8c837731ae91ba328c74b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0f857e010000 4c8d3deddafeff 418bd2 4d8b8cc7f02b0200 498bfa 4b8d04f1 443854383e }
		$sequence_1 = { 4181f880000000 72e1 448bc0 4c8d0d470c0200 0f1f8000000000 410fb6d0 }
		$sequence_2 = { 7e1f 4c8d0538dafeff 4b8b8ce0f02b0200 4803ca }
		$sequence_3 = { 0f1103 48894310 4c896b08 c7431001000000 488bce ff15???????? }
		$sequence_4 = { 498bc2 458bf1 48c1f806 488d0d80000100 4183e23f }
		$sequence_5 = { c3 48897c2408 488d3dac420100 488d05b5430100 483bc7 488b05???????? 481bc9 }
		$sequence_6 = { eb19 488d3d5e400100 eb10 488d3d65400100 eb07 488d3d44400100 }
		$sequence_7 = { 7479 488d0d86330100 483bc1 746d }
		$sequence_8 = { 4883ec20 488bd9 488bc2 488d0d053b0100 0f57c0 }
		$sequence_9 = { 3bf0 7c36 4c8d3d454e0100 49393cdf 7402 }

	condition:
		7 of them and filesize < 331776
}