MALPEDIA_Win_Ralord_Auto

rule MALPEDIA_Win_Ralord_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8f3a6578-91a7-5024-89bf-18f109157cdf"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ralord"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ralord_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "d43461015f8e50fb26d9df4c96d2c71c5033b8d47331e6463c6ace60b20aa4c4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488945a0 48c745a801000000 48c745b008000000 0f57c0 0f1145b8 488d15cf400200 488d4da0 }
		$sequence_1 = { e8???????? 4885f6 0f94c0 08c3 0f84ddfcffff e8???????? 4885c0 }
		$sequence_2 = { c3 488d05a3570100 488945d0 48c745d801000000 48c745e008000000 0f57c0 0f1145e8 }
		$sequence_3 = { 488d4df8 48894c2428 488d0d27670200 48894c2420 488d155b670200 41b808000000 4889c1 }
		$sequence_4 = { 0fb645e0 4885c9 0f8443020000 0fb6c0 0fb655e7 c1e210 440fb745e5 }
		$sequence_5 = { ba04000000 4883da00 4c01c2 4c8945b0 488955b8 }
		$sequence_6 = { cd29 0f0b 488b4530 488b00 4885c0 7406 488b4d20 }
		$sequence_7 = { 7518 eb34 48894520 4885c9 742b 666666662e0f1f840000000000 41b802000000 }
		$sequence_8 = { 0f80de010000 4839fa 7550 4c8b4dd0 4c89c8 48f7d8 0f80c9010000 }
		$sequence_9 = { ba28000000 e8???????? eb11 488b4dc8 488b55d0 c645ff00 e8???????? }

	condition:
		7 of them and filesize < 798720
}