MALPEDIA_Win_Jaku_Auto

rule MALPEDIA_Win_Jaku_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c595214-6e53-507c-b39b-9e0798e660b2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.jaku_auto.yar#L1-L264"
		license_url = "N/A"
		logic_hash = "416ce984c0d46eb134b4677dedcc369ad73398db4f37c4841cfca0c76efcbe4f"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 83c40c 894618 33db 33ff 895df4 eb0b 8b4620 }
		$sequence_1 = { 7320 897dec 8d7c7da8 0fb707 2bd0 85d2 }
		$sequence_2 = { 837df800 0f8457040000 8b45fc 8bcf }
		$sequence_3 = { c6451101 8b01 8b5510 8910 830104 8b31 8916 }
		$sequence_4 = { 0f85ff000000 8b5d08 be00400000 53 56 8d85c4bfffff }
		$sequence_5 = { 6a0f 58 8d4dc6 8b17 }
		$sequence_6 = { 7423 8d45c8 50 e8???????? 83ff02 }
		$sequence_7 = { 0f8402120000 39500c 0f84f9110000 3910 7509 }
		$sequence_8 = { 68???????? ff15???????? c3 b8???????? e8???????? 83ec2c }
		$sequence_9 = { ff742408 e8???????? c20800 8bc1 }
		$sequence_10 = { 53 68000000a0 6a03 53 }
		$sequence_11 = { 55 56 57 6880020000 }
		$sequence_12 = { 7508 83c8ff e9???????? 8b839f830000 }
		$sequence_13 = { 7507 b800308000 eb02 33c0 }
		$sequence_14 = { 5b c3 55 8bec 833d????????00 53 56 }
		$sequence_15 = { 6a01 03c3 68???????? 50 e8???????? 83c40c 85c0 }
		$sequence_16 = { 75dd 57 e8???????? 59 }
		$sequence_17 = { 50 e8???????? 59 8b4e2c }
		$sequence_18 = { e8???????? 59 eb57 53 }
		$sequence_19 = { 0245fd 3245fe 8a4dff d2c8 }
		$sequence_20 = { 85ff 7e23 8b414c 897c2410 83c004 8b08 03d1 }
		$sequence_21 = { 016c242c 8b44242c 5f 5e 5d }
		$sequence_22 = { 0175fc 8b75f8 46 8975f8 3b75f4 }
		$sequence_23 = { 017dfc 3bb188000000 75a4 5f }
		$sequence_24 = { 02c1 8845e9 8a45ee 80e30f }
		$sequence_25 = { 02c1 8845ea 8a45ee 243f }
		$sequence_26 = { 6a00 53 56 8b06 }
		$sequence_27 = { 6a00 8b9580faffff 837a3000 750b 8b8db4f9ffff 83c904 }
		$sequence_28 = { 6a00 53 57 8b07 }

	condition:
		7 of them and filesize < 2220032
}