MALPEDIA_Win_Aveo_Auto

rule MALPEDIA_Win_Aveo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fb889ef9-a682-5b51-8022-216452d8fd70"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aveo"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.aveo_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "e9f6213270d9d49b7acda0afe44bd1176c2b3c4e120bd57d3f83dcb416e84c86"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c1eb04 0bda 0fb69390fa4000 88543001 8a543901 }
		$sequence_1 = { 8b85dcfbffff 890f 8b8de4fbffff 51 52 }
		$sequence_2 = { 68???????? c705????????00000000 c705????????00000000 a3???????? c705????????0c000000 c705????????00000000 a3???????? }
		$sequence_3 = { 50 e8???????? 8bce 51 8d8578fdffff 8d8d90fdffff }
		$sequence_4 = { 0fbec2 0fbe8058e24000 83e00f eb02 33c0 0fbe84c178e24000 6a07 }
		$sequence_5 = { 83c408 8bc8 8da42400000000 8a10 40 84d2 }
		$sequence_6 = { 898500feffff 3bc3 7515 68???????? e8???????? }
		$sequence_7 = { 51 c70700000000 ffd6 8b5720 52 }
		$sequence_8 = { 8985ecfaffff 8bc6 83c408 8bc8 8a10 }
		$sequence_9 = { 50 8b85dcfbffff 890f 8b8de4fbffff }

	condition:
		7 of them and filesize < 180224
}