rule win_unidentified_121_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.unidentified_121." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_121" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8b55fc 8b4518 89420c 8b4dfc 8b551c } // n = 5, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b4518 | mov eax, dword ptr [ebp + 0x18] // 89420c | mov dword ptr [edx + 0xc], eax // 8b4dfc | mov ecx, dword ptr [ebp - 4] // 8b551c | mov edx, dword ptr [ebp + 0x1c] $sequence_1 = { 807b0c5a 0f8578fdffff 4883c30d 31d2 } // n = 4, score = 100 // 807b0c5a | rep movsd dword ptr es:[edi], dword ptr [esi] // 0f8578fdffff | dec eax // 4883c30d | lea edi, [esp + 0x48] // 31d2 | mov ecx, 0x43 $sequence_2 = { 8b55fc 8b4514 8a08 884a2d } // n = 4, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 8a08 | mov cl, byte ptr [eax] // 884a2d | mov byte ptr [edx + 0x2d], cl $sequence_3 = { 8b55fc 8b4518 894208 837dd401 } // n = 4, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b4518 | mov eax, dword ptr [ebp + 0x18] // 894208 | mov dword ptr [edx + 8], eax // 837dd401 | cmp dword ptr [ebp - 0x2c], 1 $sequence_4 = { 31c0 b90a000000 488d35779e0000 f3a5 488d7c2448 b943000000 } // n = 6, score = 100 // 31c0 | test edi, edi // b90a000000 | jns 0xfffffbc7 // 488d35779e0000 | xor eax, eax // f3a5 | mov ecx, 0xa // 488d7c2448 | dec eax // b943000000 | lea esi, [0x9e77] $sequence_5 = { 4e8d3c01 b920000000 f348ab c70700000000 0f8550010000 418b4114 } // n = 6, score = 100 // 4e8d3c01 | cmp byte ptr [ebx + 0xc], 0x5a // b920000000 | jne 0xfffffd82 // f348ab | dec eax // c70700000000 | add ebx, 0xd // 0f8550010000 | xor edx, edx // 418b4114 | dec esi $sequence_6 = { 750c 48837c242801 0f8675fbffff 85ff 0f89c1fbffff e8???????? } // n = 6, score = 100 // 750c | lea ecx, [eax + 2] // 48837c242801 | jne 0xe // 0f8675fbffff | dec eax // 85ff | cmp dword ptr [esp + 0x28], 1 // 0f89c1fbffff | jbe 0xfffffb7b // e8???????? | $sequence_7 = { 8b55fc 8b451c 89422c 8b4dfc } // n = 4, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b451c | mov eax, dword ptr [ebp + 0x1c] // 89422c | mov dword ptr [edx + 0x2c], eax // 8b4dfc | mov ecx, dword ptr [ebp - 4] $sequence_8 = { 8b55fc 8b4518 668b08 66894a32 } // n = 4, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b4518 | mov eax, dword ptr [ebp + 0x18] // 668b08 | mov cx, word ptr [eax] // 66894a32 | mov word ptr [edx + 0x32], cx $sequence_9 = { 74ae 8b4338 3b433c 7da6 488b5330 } // n = 5, score = 100 // 74ae | jne 0x164 // 8b4338 | inc ecx // 3b433c | mov eax, dword ptr [ecx + 0x14] // 7da6 | dec eax // 488b5330 | lea edx, [esp + 0xf0] $sequence_10 = { 488d9424f0000000 4889d9 ff15???????? 31c9 ff15???????? 4531c9 4531c0 } // n = 7, score = 100 // 488d9424f0000000 | lea edi, [ecx + eax] // 4889d9 | mov ecx, 0x20 // ff15???????? | // 31c9 | dec eax // ff15???????? | // 4531c9 | stosd dword ptr es:[edi], eax // 4531c0 | mov dword ptr [edi], 0 $sequence_11 = { 8b55fc 8b4518 894268 6a08 } // n = 4, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b4518 | mov eax, dword ptr [ebp + 0x18] // 894268 | mov dword ptr [edx + 0x68], eax // 6a08 | push 8 $sequence_12 = { 8b55fc 8b4520 894260 8b4dfc } // n = 4, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b4520 | mov eax, dword ptr [ebp + 0x20] // 894260 | mov dword ptr [edx + 0x60], eax // 8b4dfc | mov ecx, dword ptr [ebp - 4] $sequence_13 = { 8b55fc 8b4514 8b4d18 894204 } // n = 4, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 8b4d18 | mov ecx, dword ptr [ebp + 0x18] // 894204 | mov dword ptr [edx + 4], eax $sequence_14 = { 4889d7 4183fe01 4889d6 4519ed 4183e5fd 4183c51e 4183fe01 } // n = 7, score = 100 // 4889d7 | dec eax // 4183fe01 | mov ecx, ebx // 4889d6 | xor ecx, ecx // 4519ed | inc ebp // 4183e5fd | xor ecx, ecx // 4183c51e | inc ebp // 4183fe01 | xor eax, eax $sequence_15 = { 80fa09 0f8757ffffff 0fb65002 488d4802 } // n = 4, score = 100 // 80fa09 | cmp dl, 9 // 0f8757ffffff | ja 0xffffff5d // 0fb65002 | movzx edx, byte ptr [eax + 2] // 488d4802 | dec eax condition: 7 of them and filesize < 2419712 }