MALPEDIA_Win_Session_Manager_Auto

rule MALPEDIA_Win_Session_Manager_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3ac5c176-1ce7-5216-9a06-a6ce933fc3b7"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.session_manager"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.session_manager_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "57955d7da820e57ef7256c18ada79aa30b0281e111c371329681872a8912a1af"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ff15???????? 488d0df01d0200 ff15???????? 488d0d3b1c0200 ff15???????? ff15???????? }
		$sequence_1 = { 53 4883ec20 488d1d8cd40100 488b0b }
		$sequence_2 = { 4c89b8b8070000 4c89b8c0070000 4c89b8c8070000 4c89b8d0070000 4c89b8d8070000 4c89b8e0070000 }
		$sequence_3 = { 4c89b818080000 4c89b820080000 4c89b828080000 4c89b830080000 4c89b838080000 }
		$sequence_4 = { 7819 498b06 498bce ff5018 488b10 488bc8 ff9290000000 }
		$sequence_5 = { 488bda 488bf9 48894c2470 4883791810 7203 }
		$sequence_6 = { 41b800040000 488d8d10010000 e8???????? 488bd8 488d8510010000 }
		$sequence_7 = { 4c89b8f00a0000 4c89b8f80a0000 4c89b8000b0000 4c89b8080b0000 }
		$sequence_8 = { 418bdf 4c8d0dc254ffff 4885db 750d 488bc7 498784f1e0820200 eb25 }
		$sequence_9 = { 4c89b830060000 4c89b838060000 4c89b840060000 4c89b848060000 }

	condition:
		7 of them and filesize < 372736
}