MALPEDIA_Win_Crosswalk_Auto

rule MALPEDIA_Win_Crosswalk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7cf43d9f-bacd-5ede-9b50-cbf46214205f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crosswalk"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.crosswalk_auto.yar#L1-L167"
		license_url = "N/A"
		logic_hash = "66a6f588ae9606cfadfda7951f064572a6601950dd15ac146973fdd58f684b57"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4c8bc6 33d2 410fbe00 49ffc0 d3ca 03d0 4183ef01 }
		$sequence_1 = { 33f6 8d6e20 8bcd e8???????? }
		$sequence_2 = { ff15???????? 448bf0 4533c9 4533c0 }
		$sequence_3 = { 458d7ee0 418bd7 ff15???????? 4821742420 }
		$sequence_4 = { 4883ec28 4885c9 7402 ffd1 }
		$sequence_5 = { 8bc2 c1e81f 03d0 69c2890e0000 }
		$sequence_6 = { 458bc6 33d2 488bc8 e8???????? 4533c9 4533c0 33d2 }
		$sequence_7 = { 418bc0 f7e9 03d1 c1fa0b 8bc2 }
		$sequence_8 = { 83e13f 6bc930 53 56 8b0485808e4100 33db 8b7508 }
		$sequence_9 = { 660fd60f 8d7f08 8b048d34024100 ffe0 f7c703000000 7413 8a06 }
		$sequence_10 = { 898850030000 8b4508 59 c74048f0844100 }
		$sequence_11 = { 33c9 8b450c 0fb684c8981a4100 c1e804 }
		$sequence_12 = { 75be ddd8 db2d???????? b802000000 833d????????00 0f85a0110000 8d0dc0584100 }
		$sequence_13 = { 6bd030 895de4 8b049d808e4100 8945d4 8955e8 }
		$sequence_14 = { 57 8bf9 0f1f440000 6a00 6a00 57 }
		$sequence_15 = { 6a00 50 6a0c 53 56 ff15???????? }

	condition:
		7 of them and filesize < 286720
}