Sneed-Reactivity/yara-mikesxrs/malc0de/webc2_adspace_apt1.yar

rule webc2_adspace : apt
{
    strings:
        $a = "ntshrui"
        $b = "Microsoft(R) Windows(R) Operating System"
    condition:
        filesize < 100KB and (2 of ($a,$b))
}