rule win_flawedammyy_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.flawedammyy." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 3b58fc 0f8ebc000000 85c0 7514 } // n = 4, score = 200 // 3b58fc | cmp ebx, dword ptr [eax - 4] // 0f8ebc000000 | jle 0xc2 // 85c0 | test eax, eax // 7514 | jne 0x16 $sequence_1 = { 0000 0404 0404 0404 0401 0404 } // n = 6, score = 200 // 0000 | add byte ptr [eax], al // 0404 | add al, 4 // 0404 | add al, 4 // 0404 | add al, 4 // 0401 | add al, 1 // 0404 | add al, 4 $sequence_2 = { eb6c 682680acc8 6a01 e8???????? 83c408 68???????? eb56 } // n = 7, score = 200 // eb6c | jmp 0x6e // 682680acc8 | push 0xc8ac8026 // 6a01 | push 1 // e8???????? | // 83c408 | add esp, 8 // 68???????? | // eb56 | jmp 0x58 $sequence_3 = { ff515c 8d4df0 8bf0 e8???????? 8b4de8 51 8b11 } // n = 7, score = 200 // ff515c | call dword ptr [ecx + 0x5c] // 8d4df0 | lea ecx, [ebp - 0x10] // 8bf0 | mov esi, eax // e8???????? | // 8b4de8 | mov ecx, dword ptr [ebp - 0x18] // 51 | push ecx // 8b11 | mov edx, dword ptr [ecx] $sequence_4 = { 3b7d08 7caf 5f 5e 5b } // n = 5, score = 200 // 3b7d08 | cmp edi, dword ptr [ebp + 8] // 7caf | jl 0xffffffb1 // 5f | pop edi // 5e | pop esi // 5b | pop ebx $sequence_5 = { 3b5634 7ce8 eb76 8b4604 8b4d08 } // n = 5, score = 200 // 3b5634 | cmp edx, dword ptr [esi + 0x34] // 7ce8 | jl 0xffffffea // eb76 | jmp 0x78 // 8b4604 | mov eax, dword ptr [esi + 4] // 8b4d08 | mov ecx, dword ptr [ebp + 8] $sequence_6 = { 3b5808 7e0f 8bce e8???????? } // n = 4, score = 200 // 3b5808 | cmp ebx, dword ptr [eax + 8] // 7e0f | jle 0x11 // 8bce | mov ecx, esi // e8???????? | $sequence_7 = { 3b5634 7d22 8b4df8 8d4206 } // n = 4, score = 200 // 3b5634 | cmp edx, dword ptr [esi + 0x34] // 7d22 | jge 0x24 // 8b4df8 | mov ecx, dword ptr [ebp - 8] // 8d4206 | lea eax, [edx + 6] $sequence_8 = { 8d85bcfcffff 68???????? 50 ffd3 68dff0f081 6a01 e8???????? } // n = 7, score = 200 // 8d85bcfcffff | lea eax, [ebp - 0x344] // 68???????? | // 50 | push eax // ffd3 | call ebx // 68dff0f081 | push 0x81f0f0df // 6a01 | push 1 // e8???????? | $sequence_9 = { 8d85bcfdffff 50 68???????? e8???????? 83c408 } // n = 5, score = 200 // 8d85bcfdffff | lea eax, [ebp - 0x244] // 50 | push eax // 68???????? | // e8???????? | // 83c408 | add esp, 8 $sequence_10 = { 8365fc00 8b45e4 8b048588ae4100 f644180401 7418 ff7514 ff7510 } // n = 7, score = 200 // 8365fc00 | and dword ptr [ebp - 4], 0 // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] // 8b048588ae4100 | mov eax, dword ptr [eax*4 + 0x41ae88] // f644180401 | test byte ptr [eax + ebx + 4], 1 // 7418 | je 0x1a // ff7514 | push dword ptr [ebp + 0x14] // ff7510 | push dword ptr [ebp + 0x10] $sequence_11 = { 72c3 5e 8aca 5f 88b800010000 888801010000 } // n = 6, score = 200 // 72c3 | jb 0xffffffc5 // 5e | pop esi // 8aca | mov cl, dl // 5f | pop edi // 88b800010000 | mov byte ptr [eax + 0x100], bh // 888801010000 | mov byte ptr [eax + 0x101], cl $sequence_12 = { 3b573c 7ca8 8b5d1c 8b87dc000000 } // n = 4, score = 200 // 3b573c | cmp edx, dword ptr [edi + 0x3c] // 7ca8 | jl 0xffffffaa // 8b5d1c | mov ebx, dword ptr [ebp + 0x1c] // 8b87dc000000 | mov eax, dword ptr [edi + 0xdc] $sequence_13 = { 3b5910 0f82de000000 8d4508 50 } // n = 4, score = 200 // 3b5910 | cmp ebx, dword ptr [ecx + 0x10] // 0f82de000000 | jb 0xe4 // 8d4508 | lea eax, [ebp + 8] // 50 | push eax $sequence_14 = { e8???????? 83c408 68???????? 56 ffd0 68???????? } // n = 6, score = 200 // e8???????? | // 83c408 | add esp, 8 // 68???????? | // 56 | push esi // ffd0 | call eax // 68???????? | $sequence_15 = { 0fbe80a8384100 83e00f eb02 33c0 8bbdbcfdffff 0fbebcc7c8384100 } // n = 6, score = 200 // 0fbe80a8384100 | movsx eax, byte ptr [eax + 0x4138a8] // 83e00f | and eax, 0xf // eb02 | jmp 4 // 33c0 | xor eax, eax // 8bbdbcfdffff | mov edi, dword ptr [ebp - 0x244] // 0fbebcc7c8384100 | movsx edi, byte ptr [edi + eax*8 + 0x4138c8] $sequence_16 = { eb08 6a64 ff15???????? 53 ff75a8 ff15???????? } // n = 6, score = 100 // eb08 | jmp 0xa // 6a64 | push 0x64 // ff15???????? | // 53 | push ebx // ff75a8 | push dword ptr [ebp - 0x58] // ff15???????? | $sequence_17 = { 50 881f ff15???????? 53 8d85ccfdffff 56 50 } // n = 7, score = 100 // 50 | push eax // 881f | mov byte ptr [edi], bl // ff15???????? | // 53 | push ebx // 8d85ccfdffff | lea eax, [ebp - 0x234] // 56 | push esi // 50 | push eax $sequence_18 = { 8b3d???????? ffd7 ff75a8 ffd7 ff75dc } // n = 5, score = 100 // 8b3d???????? | // ffd7 | call edi // ff75a8 | push dword ptr [ebp - 0x58] // ffd7 | call edi // ff75dc | push dword ptr [ebp - 0x24] $sequence_19 = { 7431 6aff ff75e8 ff15???????? 8d45f8 50 ff75e8 } // n = 7, score = 100 // 7431 | je 0x33 // 6aff | push -1 // ff75e8 | push dword ptr [ebp - 0x18] // ff15???????? | // 8d45f8 | lea eax, [ebp - 8] // 50 | push eax // ff75e8 | push dword ptr [ebp - 0x18] $sequence_20 = { 8b7df4 8b0c855c303400 c1e705 33d2 03fe 42 837dfcff } // n = 7, score = 100 // 8b7df4 | mov edi, dword ptr [ebp - 0xc] // 8b0c855c303400 | mov ecx, dword ptr [eax*4 + 0x34305c] // c1e705 | shl edi, 5 // 33d2 | xor edx, edx // 03fe | add edi, esi // 42 | inc edx // 837dfcff | cmp dword ptr [ebp - 4], -1 $sequence_21 = { 8b46f8 8b04855c303400 c1e002 50 6a40 } // n = 5, score = 100 // 8b46f8 | mov eax, dword ptr [esi - 8] // 8b04855c303400 | mov eax, dword ptr [eax*4 + 0x34305c] // c1e002 | shl eax, 2 // 50 | push eax // 6a40 | push 0x40 $sequence_22 = { 834de4ff 49 c745e8ff000000 8b3c857c303400 c745ecffff0000 } // n = 5, score = 100 // 834de4ff | or dword ptr [ebp - 0x1c], 0xffffffff // 49 | dec ecx // c745e8ff000000 | mov dword ptr [ebp - 0x18], 0xff // 8b3c857c303400 | mov edi, dword ptr [eax*4 + 0x34307c] // c745ecffff0000 | mov dword ptr [ebp - 0x14], 0xffff $sequence_23 = { ff15???????? a1???????? 56 85c0 742f 8b30 } // n = 6, score = 100 // ff15???????? | // a1???????? | // 56 | push esi // 85c0 | test eax, eax // 742f | je 0x31 // 8b30 | mov esi, dword ptr [eax] $sequence_24 = { 8bfe 381e 0f848e000000 8a06 3c0d } // n = 5, score = 100 // 8bfe | mov edi, esi // 381e | cmp byte ptr [esi], bl // 0f848e000000 | je 0x94 // 8a06 | mov al, byte ptr [esi] // 3c0d | cmp al, 0xd $sequence_25 = { e8???????? 8bf8 59 3bfb 59 75a4 8b75fc } // n = 7, score = 100 // e8???????? | // 8bf8 | mov edi, eax // 59 | pop ecx // 3bfb | cmp edi, ebx // 59 | pop ecx // 75a4 | jne 0xffffffa6 // 8b75fc | mov esi, dword ptr [ebp - 4] $sequence_26 = { ff15???????? e9???????? 57 8945e4 } // n = 4, score = 100 // ff15???????? | // e9???????? | // 57 | push edi // 8945e4 | mov dword ptr [ebp - 0x1c], eax $sequence_27 = { 8b14957c303400 49 0fafd1 0155fc } // n = 4, score = 100 // 8b14957c303400 | mov edx, dword ptr [edx*4 + 0x34307c] // 49 | dec ecx // 0fafd1 | imul edx, ecx // 0155fc | add dword ptr [ebp - 4], edx $sequence_28 = { 83f855 0f872affffff 0fb6805a213400 ff2485f6203400 8b8614080000 3b45f4 } // n = 6, score = 100 // 83f855 | cmp eax, 0x55 // 0f872affffff | ja 0xffffff30 // 0fb6805a213400 | movzx eax, byte ptr [eax + 0x34215a] // ff2485f6203400 | jmp dword ptr [eax*4 + 0x3420f6] // 8b8614080000 | mov eax, dword ptr [esi + 0x814] // 3b45f4 | cmp eax, dword ptr [ebp - 0xc] $sequence_29 = { 751e 837efcff 7518 8b46f8 8b04855c303400 } // n = 5, score = 100 // 751e | jne 0x20 // 837efcff | cmp dword ptr [esi - 4], -1 // 7518 | jne 0x1a // 8b46f8 | mov eax, dword ptr [esi - 8] // 8b04855c303400 | mov eax, dword ptr [eax*4 + 0x34305c] $sequence_30 = { c705????????4c403400 ff7508 ff15???????? 5a } // n = 4, score = 100 // c705????????4c403400 | // ff7508 | push dword ptr [ebp + 8] // ff15???????? | // 5a | pop edx $sequence_31 = { 83661c00 83f807 0f87c9000000 ff248580233400 832700 e9???????? } // n = 6, score = 100 // 83661c00 | and dword ptr [esi + 0x1c], 0 // 83f807 | cmp eax, 7 // 0f87c9000000 | ja 0xcf // ff248580233400 | jmp dword ptr [eax*4 + 0x342380] // 832700 | and dword ptr [edi], 0 // e9???????? | condition: 7 of them and filesize < 1350656 }