rule win_acronym_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.acronym."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acronym"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b4dfc 8b11 8b45fc 50 8b4a34 ffd1 8945f8 }
            // n = 7, score = 200
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   8b11                 | mov                 edx, dword ptr [ecx]
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   50                   | push                eax
            //   8b4a34               | mov                 ecx, dword ptr [edx + 0x34]
            //   ffd1                 | call                ecx
            //   8945f8               | mov                 dword ptr [ebp - 8], eax

        $sequence_1 = { 8b4df0 668b1441 66895584 c745d800000000 eb09 8b45d8 83c001 }
            // n = 7, score = 200
            //   8b4df0               | mov                 ecx, dword ptr [ebp - 0x10]
            //   668b1441             | mov                 dx, word ptr [ecx + eax*2]
            //   66895584             | mov                 word ptr [ebp - 0x7c], dx
            //   c745d800000000       | mov                 dword ptr [ebp - 0x28], 0
            //   eb09                 | jmp                 0xb
            //   8b45d8               | mov                 eax, dword ptr [ebp - 0x28]
            //   83c001               | add                 eax, 1

        $sequence_2 = { 8b048a 8945ac 8b4df8 8b5508 8b45f4 8b7508 }
            // n = 6, score = 200
            //   8b048a               | mov                 eax, dword ptr [edx + ecx*4]
            //   8945ac               | mov                 dword ptr [ebp - 0x54], eax
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]

        $sequence_3 = { 8b4508 8d941060b10000 8b048a 83c001 8b4df4 8b55f0 0fb74c4a5c }
            // n = 7, score = 200
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d941060b10000       | lea                 edx, [eax + edx + 0xb160]
            //   8b048a               | mov                 eax, dword ptr [edx + ecx*4]
            //   83c001               | add                 eax, 1
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   8b55f0               | mov                 edx, dword ptr [ebp - 0x10]
            //   0fb74c4a5c           | movzx               ecx, word ptr [edx + ecx*2 + 0x5c]

        $sequence_4 = { e9???????? 8d55d0 52 8b4ddc e8???????? 50 8d4d0c }
            // n = 7, score = 200
            //   e9????????           |                     
            //   8d55d0               | lea                 edx, [ebp - 0x30]
            //   52                   | push                edx
            //   8b4ddc               | mov                 ecx, dword ptr [ebp - 0x24]
            //   e8????????           |                     
            //   50                   | push                eax
            //   8d4d0c               | lea                 ecx, [ebp + 0xc]

        $sequence_5 = { 8845fe 8b4df8 8b55f8 8b4150 3b424c 7d05 e9???????? }
            // n = 7, score = 200
            //   8845fe               | mov                 byte ptr [ebp - 2], al
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]
            //   8b4150               | mov                 eax, dword ptr [ecx + 0x50]
            //   3b424c               | cmp                 eax, dword ptr [edx + 0x4c]
            //   7d05                 | jge                 7
            //   e9????????           |                     

        $sequence_6 = { c785bcfbffff04010000 8d8dbcfbffff 51 8d95f4fdffff 52 ff15???????? 33c0 }
            // n = 7, score = 200
            //   c785bcfbffff04010000     | mov    dword ptr [ebp - 0x444], 0x104
            //   8d8dbcfbffff         | lea                 ecx, [ebp - 0x444]
            //   51                   | push                ecx
            //   8d95f4fdffff         | lea                 edx, [ebp - 0x20c]
            //   52                   | push                edx
            //   ff15????????         |                     
            //   33c0                 | xor                 eax, eax

        $sequence_7 = { 51 8b4ddc e8???????? 8b4508 e9???????? c645ef01 e9???????? }
            // n = 7, score = 200
            //   51                   | push                ecx
            //   8b4ddc               | mov                 ecx, dword ptr [ebp - 0x24]
            //   e8????????           |                     
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   e9????????           |                     
            //   c645ef01             | mov                 byte ptr [ebp - 0x11], 1
            //   e9????????           |                     

        $sequence_8 = { ff15???????? 33c0 668985ecfbffff 6806020000 6a00 8d8deefbffff 51 }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   33c0                 | xor                 eax, eax
            //   668985ecfbffff       | mov                 word ptr [ebp - 0x414], ax
            //   6806020000           | push                0x206
            //   6a00                 | push                0
            //   8d8deefbffff         | lea                 ecx, [ebp - 0x412]
            //   51                   | push                ecx

        $sequence_9 = { 83c404 ff15???????? 33d2 b9e8030000 f7f1 8b55f4 89420c }
            // n = 7, score = 200
            //   83c404               | add                 esp, 4
            //   ff15????????         |                     
            //   33d2                 | xor                 edx, edx
            //   b9e8030000           | mov                 ecx, 0x3e8
            //   f7f1                 | div                 ecx
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   89420c               | mov                 dword ptr [edx + 0xc], eax

    condition:
        7 of them and filesize < 466944
}