MALPEDIA_Win_Sync_Scheduler_Auto

rule MALPEDIA_Win_Sync_Scheduler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "95610e1b-5db4-50de-ac44-e5e2c59c0bb8"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sync_scheduler"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.sync_scheduler_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "bcac8eebb558ac10a1437f8e96772342840ecc807b424b4bd7b054cc8b3bdd2d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488d4808 0f1102 ff15???????? 488d05dfa30000 488903 }
		$sequence_1 = { 48c7c7ffffffff 4d8b6f10 0f1f840000000000 48ffc7 6641391478 75f6 }
		$sequence_2 = { e8???????? 83cf02 897df7 488d55ff }
		$sequence_3 = { 488d542424 498bc9 e8???????? 0f1000 0f1185e0010000 0f104810 }
		$sequence_4 = { 4885c0 7431 4883c027 4883e0e0 488948f8 eb39 483bf1 }
		$sequence_5 = { 488d05216a0000 4889843a58ffffff 488b01 48634804 }
		$sequence_6 = { c645ab55 c645ac54 c645ad57 c645ae56 c645af51 c645b050 }
		$sequence_7 = { 48c705????????00000000 b9e0010000 e8???????? 488bf8 488905???????? 488905???????? }
		$sequence_8 = { eb1d ff15???????? cc 488bd6 e8???????? 4d89241e 4d89641e08 }
		$sequence_9 = { 0408 3464 8844244c 8b442440 }

	condition:
		7 of them and filesize < 156672
}