MALPEDIA_Win_Pushdo_Auto

rule MALPEDIA_Win_Pushdo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a1ffdce5-e219-5722-859f-7352631942e0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.pushdo_auto.yar#L1-L206"
		license_url = "N/A"
		logic_hash = "487e6aed24b5faaf6c86462f2c72494efb38c0ee89b861a714a37b5e1e9cc734"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 50 ff15???????? 33d2 b9ffff0000 }
		$sequence_1 = { f7f9 33c9 ba88020000 f7e2 0f90c1 f7d9 }
		$sequence_2 = { 60 8b45fc b10b d3c0 61 }
		$sequence_3 = { 0fbe8c05f0feffff 8b45f4 0fbe8405f0feffff 03c8 81e1ff000000 }
		$sequence_4 = { 03c8 81e1ff000000 0fbe8c0df0feffff 33d1 8b450c 0345fc }
		$sequence_5 = { 8b45fc 33d2 f77518 8b4514 }
		$sequence_6 = { 8b95e8feffff 8b45fc 8a8c05f0feffff 888c15f0feffff 8b55fc }
		$sequence_7 = { f77518 8b4514 0fbe1410 03ca 81e1ff000000 898de8feffff }
		$sequence_8 = { be???????? 56 ff75fc c745f820000000 }
		$sequence_9 = { 59 6a04 8945f8 8d45f8 }
		$sequence_10 = { 83ec24 33c0 8945e0 394508 0f84c1010000 }
		$sequence_11 = { 33c0 85ff 743a 53 8b5d0c 85db }
		$sequence_12 = { 8b4608 8945e0 8b4614 8945ec 8b460c 8945e4 }
		$sequence_13 = { 52 8d8588fbffff 50 e8???????? }
		$sequence_14 = { eb67 eb93 6a00 6a04 8d4de0 }
		$sequence_15 = { 894de8 8b5514 0355e4 895514 8b4518 2b45e4 894518 }
		$sequence_16 = { 0fbe08 85c9 0f84ba010000 8b5508 8955fc }
		$sequence_17 = { 50 8b0d???????? 51 8b15???????? 52 8b854cfeffff 50 }
		$sequence_18 = { 7e2d 0fbe4d08 83f930 7c09 0fbe5508 83fa39 }
		$sequence_19 = { ff15???????? 898524feffff 83bd24feffff00 7552 }
		$sequence_20 = { 50 e8???????? 8945b8 68???????? 8b4db8 }

	condition:
		7 of them and filesize < 163840
}