MALPEDIA_Win_Imprudentcook_Auto

rule MALPEDIA_Win_Imprudentcook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "75e4592d-21ea-5b74-beda-d75f8caa17c5"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.imprudentcook"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.imprudentcook_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "74810614a85d779678d01380c3bcf3dcf793e759fae3ba5e3f5874f62d02ccb3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 488b5520 894500 8b4528 83f803 7527 488b4508 }
		$sequence_1 = { 3b3d???????? 736e 488bdf 4c8bef 49c1fd05 4c8d35384d0200 83e31f }
		$sequence_2 = { 753a 4883e908 48ffc8 79eb 488b8c2498000000 4489642428 4d85f6 }
		$sequence_3 = { 4c2bc1 49c1e020 4d0bc3 4c3bc2 731a 498b45f8 49ffca }
		$sequence_4 = { 4983ec08 493bfd 0f8211020000 4989742408 7732 7563 4d8bcc }
		$sequence_5 = { 4b0104ec 4d85f6 7430 488b4d28 4d8d46ff 498bc4 }
		$sequence_6 = { 482bfa 660f1f440000 488b0c3b 488b13 483bca 0f8599000000 4883eb08 }
		$sequence_7 = { 4c8bc6 48898580000000 e8???????? 48894510 4885c0 7452 660f1f840000000000 }
		$sequence_8 = { 4c8b7c2460 4c8b942408010000 4a8d1c38 4f8d2c12 493bdd 7d41 488b842438010000 }
		$sequence_9 = { 488905???????? e8???????? 488d15d3ec0400 488bcb 488905???????? e8???????? 488d15d5ec0400 }

	condition:
		7 of them and filesize < 864256
}