MALPEDIA_Win_Toughprogress_Auto

rule MALPEDIA_Win_Toughprogress_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "479b9480-8efa-5049-b86e-7e3e91762757"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.toughprogress"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.toughprogress_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "406a3832e729608f1528f3996a58b544fb6c497823fa857be31a03a868c4a293"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f00fc101 83f801 7512 488d053e820600 483bc8 7406 e8???????? }
		$sequence_1 = { 53 4189d0 4180e007 c1ea03 440fb60c11 4489c8 f7d0 }
		$sequence_2 = { ffd0 488b4df8 488b15???????? 4c8b0c32 4d01e9 4889c2 4989d8 }
		$sequence_3 = { 48bb136f553659972b06 488b0408 4801d8 4889d1 ffd0 488b05???????? 48b9ef6e1e2c733fced7 }
		$sequence_4 = { 48bf6f0c78c0a7583d67 488b0408 4801f8 4889d1 ffd0 0fb700 668906 }
		$sequence_5 = { 794a 0fb65678 488b05???????? 48b93faa3d93bf1e803d 488b0408 4c01c8 4889f1 }
		$sequence_6 = { 666666662e0f1f840000000000 4c89c8 49f7e2 48d1ea 4883e2f8 488d0452 4b8d1408 }
		$sequence_7 = { 4c894708 894718 410fb608 83e10f 4a0fbe841110361000 428a8c1120361000 4c2bc0 }
		$sequence_8 = { 488d0dd0dc0e00 ffd0 48bbab8be2c7a3ecddc7 48031d???????? 488b05???????? 48b950bd9f47f0766383 49bf5b1d11895113db65 }
		$sequence_9 = { 85c0 0f95c1 48c1e104 48030d???????? 48b8e701c589e09907ad 48bf3c3732457de63ecb 488b0408 }

	condition:
		7 of them and filesize < 3117056
}