MALPEDIA_Win_Juicy_Potato_Auto

rule MALPEDIA_Win_Juicy_Potato_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "84a4407a-99f0-5710-abf4-abb943de48d7"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.juicy_potato"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.juicy_potato_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "3ee4e46af149d5e35c17ac679fe71d89a45dde816af90c430a29bfe439fef7a5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4883ec20 488d05c3d20100 488bd9 488901 }
		$sequence_1 = { 488b8b20010000 e8???????? 488db328010000 bd06000000 488d7b38 488d05aecf0300 483947f0 }
		$sequence_2 = { 57 4883ec20 418be8 4c8d0d52090300 }
		$sequence_3 = { 488907 488d057f740100 48894710 33c0 80a727010000fc 48898700010000 48898708010000 }
		$sequence_4 = { 4885c0 7509 488d0527200400 eb04 }
		$sequence_5 = { 488d4b30 4c8bc3 488d15075bffff e8???????? 488b5b28 }
		$sequence_6 = { 488bc8 488d152e9c0100 ff15???????? 4885c0 0f842c030000 488bc8 }
		$sequence_7 = { 83f8ff 7504 32c0 eb1b 488d15fa8a0400 8bc8 }
		$sequence_8 = { 488d0d41240400 e8???????? 488d45f0 4889442428 89742420 4c8bcf 4c8d0595efffff }
		$sequence_9 = { 4889442430 488d542468 c744242801000000 4533c0 33c9 48895c2420 }

	condition:
		7 of them and filesize < 736256
}