MALPEDIA_Win_Roadsweep_Auto

rule MALPEDIA_Win_Roadsweep_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "457a8e82-690e-5c1c-a05d-57aa290d990e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roadsweep"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.roadsweep_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "2131496e6ed42ed2d60d74238181574c33222c59aa35c635fff777007237206e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 53 83ec1c 8b7d08 8b5d14 8b470c 29d8 8d58ff }
		$sequence_1 = { 4b 75f6 ebdd 8b0d???????? }
		$sequence_2 = { 85c0 7512 8b15???????? 85d2 7808 89ec }
		$sequence_3 = { 83e101 01c9 e9???????? 85c0 7e5b 89442404 8d55c8 }
		$sequence_4 = { c7442408???????? c744240403010000 891c24 e8???????? 8b15???????? 8d8db8f9ffff }
		$sequence_5 = { 8d448001 89c7 e9???????? 837d0cfe b801000000 74ee 8b4d14 }
		$sequence_6 = { 8b15???????? 85d2 7415 89442404 8b5a10 891c24 }
		$sequence_7 = { a1???????? c745d441414141 893424 8945e4 a1???????? 8945e8 }
		$sequence_8 = { 807df300 7406 8b17 01d0 8b00 8d1438 8b03 }
		$sequence_9 = { 0fbe45da 0fbe55d9 25c0000000 83e20f c1f806 0fb68c90b0914000 8b4508 }

	condition:
		7 of them and filesize < 160768
}