rule win_pushdo_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.pushdo." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { f7f9 33c9 ba88020000 f7e2 } // n = 4, score = 1300 // f7f9 | idiv ecx // 33c9 | xor ecx, ecx // ba88020000 | mov edx, 0x288 // f7e2 | mul edx $sequence_1 = { 50 ff15???????? 33d2 b9ffff0000 } // n = 4, score = 1300 // 50 | push eax // ff15???????? | // 33d2 | xor edx, edx // b9ffff0000 | mov ecx, 0xffff $sequence_2 = { 60 8b45fc b10b d3c0 61 } // n = 5, score = 1200 // 60 | pushal // 8b45fc | mov eax, dword ptr [ebp - 4] // b10b | mov cl, 0xb // d3c0 | rol eax, cl // 61 | popal $sequence_3 = { 8b45fc 33d2 f77518 8b4514 0fbe1410 03ca 81e1ff000000 } // n = 7, score = 800 // 8b45fc | mov eax, dword ptr [ebp - 4] // 33d2 | xor edx, edx // f77518 | div dword ptr [ebp + 0x18] // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 0fbe1410 | movsx edx, byte ptr [eax + edx] // 03ca | add ecx, edx // 81e1ff000000 | and ecx, 0xff $sequence_4 = { 8b4df8 8811 ebd2 c785e8feffff00000000 } // n = 4, score = 800 // 8b4df8 | mov ecx, dword ptr [ebp - 8] // 8811 | mov byte ptr [ecx], dl // ebd2 | jmp 0xffffffd4 // c785e8feffff00000000 | mov dword ptr [ebp - 0x118], 0 $sequence_5 = { 817dfc00010000 736a 8b45fc 0fbe8c05f0feffff } // n = 4, score = 800 // 817dfc00010000 | cmp dword ptr [ebp - 4], 0x100 // 736a | jae 0x6c // 8b45fc | mov eax, dword ptr [ebp - 4] // 0fbe8c05f0feffff | movsx ecx, byte ptr [ebp + eax - 0x110] $sequence_6 = { 8b45fc 8a8c05f0feffff 888c15f0feffff 8b55fc 8a85effeffff 888415f0feffff } // n = 6, score = 800 // 8b45fc | mov eax, dword ptr [ebp - 4] // 8a8c05f0feffff | mov cl, byte ptr [ebp + eax - 0x110] // 888c15f0feffff | mov byte ptr [ebp + edx - 0x110], cl // 8b55fc | mov edx, dword ptr [ebp - 4] // 8a85effeffff | mov al, byte ptr [ebp - 0x111] // 888415f0feffff | mov byte ptr [ebp + edx - 0x110], al $sequence_7 = { 8a85effeffff 888415f0feffff 8b4d08 034dfc 0fbe11 8b85e8feffff } // n = 6, score = 800 // 8a85effeffff | mov al, byte ptr [ebp - 0x111] // 888415f0feffff | mov byte ptr [ebp + edx - 0x110], al // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 034dfc | add ecx, dword ptr [ebp - 4] // 0fbe11 | movsx edx, byte ptr [ecx] // 8b85e8feffff | mov eax, dword ptr [ebp - 0x118] $sequence_8 = { 394508 0f84ce000000 8b750c 3bf0 0f84c3000000 394514 0f84ba000000 } // n = 7, score = 600 // 394508 | cmp dword ptr [ebp + 8], eax // 0f84ce000000 | je 0xd4 // 8b750c | mov esi, dword ptr [ebp + 0xc] // 3bf0 | cmp esi, eax // 0f84c3000000 | je 0xc9 // 394514 | cmp dword ptr [ebp + 0x14], eax // 0f84ba000000 | je 0xc0 $sequence_9 = { 50 895df8 ff15???????? 50 8d857cf5ffff 50 } // n = 6, score = 600 // 50 | push eax // 895df8 | mov dword ptr [ebp - 8], ebx // ff15???????? | // 50 | push eax // 8d857cf5ffff | lea eax, [ebp - 0xa84] // 50 | push eax $sequence_10 = { 397dfc 746a 8b35???????? 8d45f4 } // n = 4, score = 600 // 397dfc | cmp dword ptr [ebp - 4], edi // 746a | je 0x6c // 8b35???????? | // 8d45f4 | lea eax, [ebp - 0xc] $sequence_11 = { 771c ff750c 8d043e 50 e8???????? 59 59 } // n = 7, score = 600 // 771c | ja 0x1e // ff750c | push dword ptr [ebp + 0xc] // 8d043e | lea eax, [esi + edi] // 50 | push eax // e8???????? | // 59 | pop ecx // 59 | pop ecx $sequence_12 = { 57 8d4618 50 55 e8???????? 6a20 } // n = 6, score = 600 // 57 | push edi // 8d4618 | lea eax, [esi + 0x18] // 50 | push eax // 55 | push ebp // e8???????? | // 6a20 | push 0x20 $sequence_13 = { 52 8d8588fbffff 50 e8???????? } // n = 4, score = 500 // 52 | push edx // 8d8588fbffff | lea eax, [ebp - 0x478] // 50 | push eax // e8???????? | $sequence_14 = { 83ec20 a1???????? 8945e4 8a0d???????? 884de8 8b15???????? 8955e9 } // n = 7, score = 200 // 83ec20 | sub esp, 0x20 // a1???????? | // 8945e4 | mov dword ptr [ebp - 0x1c], eax // 8a0d???????? | // 884de8 | mov byte ptr [ebp - 0x18], cl // 8b15???????? | // 8955e9 | mov dword ptr [ebp - 0x17], edx $sequence_15 = { 8b4508 0fb708 0fafd1 0355f8 8955f8 8b5508 83c202 } // n = 7, score = 200 // 8b4508 | mov eax, dword ptr [ebp + 8] // 0fb708 | movzx ecx, word ptr [eax] // 0fafd1 | imul edx, ecx // 0355f8 | add edx, dword ptr [ebp - 8] // 8955f8 | mov dword ptr [ebp - 8], edx // 8b5508 | mov edx, dword ptr [ebp + 8] // 83c202 | add edx, 2 $sequence_16 = { 8b4d0c 83c101 894d0c 8b55ec } // n = 4, score = 200 // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 83c101 | add ecx, 1 // 894d0c | mov dword ptr [ebp + 0xc], ecx // 8b55ec | mov edx, dword ptr [ebp - 0x14] $sequence_17 = { 8b4de8 034de4 894de8 8b5514 0355e4 895514 } // n = 6, score = 200 // 8b4de8 | mov ecx, dword ptr [ebp - 0x18] // 034de4 | add ecx, dword ptr [ebp - 0x1c] // 894de8 | mov dword ptr [ebp - 0x18], ecx // 8b5514 | mov edx, dword ptr [ebp + 0x14] // 0355e4 | add edx, dword ptr [ebp - 0x1c] // 895514 | mov dword ptr [ebp + 0x14], edx $sequence_18 = { 7308 8b55cc 3b55fc 7204 33c0 eb33 8b450c } // n = 7, score = 200 // 7308 | jae 0xa // 8b55cc | mov edx, dword ptr [ebp - 0x34] // 3b55fc | cmp edx, dword ptr [ebp - 4] // 7204 | jb 6 // 33c0 | xor eax, eax // eb33 | jmp 0x35 // 8b450c | mov eax, dword ptr [ebp + 0xc] $sequence_19 = { 52 8b45ec 50 ff15???????? 8945e4 837de400 7406 } // n = 7, score = 200 // 52 | push edx // 8b45ec | mov eax, dword ptr [ebp - 0x14] // 50 | push eax // ff15???????? | // 8945e4 | mov dword ptr [ebp - 0x1c], eax // 837de400 | cmp dword ptr [ebp - 0x1c], 0 // 7406 | je 8 $sequence_20 = { 8b4df4 c1e105 8b5508 837c0a0400 } // n = 4, score = 200 // 8b4df4 | mov ecx, dword ptr [ebp - 0xc] // c1e105 | shl ecx, 5 // 8b5508 | mov edx, dword ptr [ebp + 8] // 837c0a0400 | cmp dword ptr [edx + ecx + 4], 0 condition: 7 of them and filesize < 163840 }