rule win_applejeus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.applejeus."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c785d8e8ffff00000000 c78544e7ffff00000000 8b7004 c785dce8ffff00000000 c78548e7ffff00000000 c785e0e8ffff00000000 c7854ce7ffff00000000 }
            // n = 7, score = 100
            //   c785d8e8ffff00000000     | mov    dword ptr [ebp - 0x1728], 0
            //   c78544e7ffff00000000     | mov    dword ptr [ebp - 0x18bc], 0
            //   8b7004               | mov                 esi, dword ptr [eax + 4]
            //   c785dce8ffff00000000     | mov    dword ptr [ebp - 0x1724], 0
            //   c78548e7ffff00000000     | mov    dword ptr [ebp - 0x18b8], 0
            //   c785e0e8ffff00000000     | mov    dword ptr [ebp - 0x1720], 0
            //   c7854ce7ffff00000000     | mov    dword ptr [ebp - 0x18b4], 0

        $sequence_1 = { 8bec 51 c745fc00000000 c745fcdf070000 8b55fc 56 8bf1 }
            // n = 7, score = 100
            //   8bec                 | mov                 ebp, esp
            //   51                   | push                ecx
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   c745fcdf070000       | mov                 dword ptr [ebp - 4], 0x7df
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx

        $sequence_2 = { 8b0b 8bc1 83e13f c1f806 6bc930 8b048538f14800 80640828fe }
            // n = 7, score = 100
            //   8b0b                 | mov                 ecx, dword ptr [ebx]
            //   8bc1                 | mov                 eax, ecx
            //   83e13f               | and                 ecx, 0x3f
            //   c1f806               | sar                 eax, 6
            //   6bc930               | imul                ecx, ecx, 0x30
            //   8b048538f14800       | mov                 eax, dword ptr [eax*4 + 0x48f138]
            //   80640828fe           | and                 byte ptr [eax + ecx + 0x28], 0xfe

        $sequence_3 = { 43 00602c 43 00b05b4300b0 354300905c 43 00602c }
            // n = 7, score = 100
            //   43                   | inc                 ebx
            //   00602c               | add                 byte ptr [eax + 0x2c], ah
            //   43                   | inc                 ebx
            //   00b05b4300b0         | add                 byte ptr [eax - 0x4fffbca5], dh
            //   354300905c           | xor                 eax, 0x5c900043
            //   43                   | inc                 ebx
            //   00602c               | add                 byte ptr [eax + 0x2c], ah

        $sequence_4 = { 8b442408 35490f0000 8b0e 351b090000 50 8d442414 50 }
            // n = 7, score = 100
            //   8b442408             | mov                 eax, dword ptr [esp + 8]
            //   35490f0000           | xor                 eax, 0xf49
            //   8b0e                 | mov                 ecx, dword ptr [esi]
            //   351b090000           | xor                 eax, 0x91b
            //   50                   | push                eax
            //   8d442414             | lea                 eax, dword ptr [esp + 0x14]
            //   50                   | push                eax

        $sequence_5 = { 8d4e10 e8???????? c745fc01000000 8b45b8 85c0 7419 a801 }
            // n = 7, score = 100
            //   8d4e10               | lea                 ecx, dword ptr [esi + 0x10]
            //   e8????????           |                     
            //   c745fc01000000       | mov                 dword ptr [ebp - 4], 1
            //   8b45b8               | mov                 eax, dword ptr [ebp - 0x48]
            //   85c0                 | test                eax, eax
            //   7419                 | je                  0x1b
            //   a801                 | test                al, 1

        $sequence_6 = { 81f2490f0000 c7854cffffff01090000 80f2a0 8b8d4cffffff 8b07 81f1490f0000 }
            // n = 6, score = 100
            //   81f2490f0000         | xor                 edx, 0xf49
            //   c7854cffffff01090000     | mov    dword ptr [ebp - 0xb4], 0x901
            //   80f2a0               | xor                 dl, 0xa0
            //   8b8d4cffffff         | mov                 ecx, dword ptr [ebp - 0xb4]
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   81f1490f0000         | xor                 ecx, 0xf49

        $sequence_7 = { 83f077 88855bfeffff 8b8538feffff 0420 83f050 88855cfeffff 8b8538feffff }
            // n = 7, score = 100
            //   83f077               | xor                 eax, 0x77
            //   88855bfeffff         | mov                 byte ptr [ebp - 0x1a5], al
            //   8b8538feffff         | mov                 eax, dword ptr [ebp - 0x1c8]
            //   0420                 | add                 al, 0x20
            //   83f050               | xor                 eax, 0x50
            //   88855cfeffff         | mov                 byte ptr [ebp - 0x1a4], al
            //   8b8538feffff         | mov                 eax, dword ptr [ebp - 0x1c8]

        $sequence_8 = { 0f84d3000000 8b048d74db4500 8985a4f8ffff 85c0 0f8498000000 83f801 0f84b5000000 }
            // n = 7, score = 100
            //   0f84d3000000         | je                  0xd9
            //   8b048d74db4500       | mov                 eax, dword ptr [ecx*4 + 0x45db74]
            //   8985a4f8ffff         | mov                 dword ptr [ebp - 0x75c], eax
            //   85c0                 | test                eax, eax
            //   0f8498000000         | je                  0x9e
            //   83f801               | cmp                 eax, 1
            //   0f84b5000000         | je                  0xbb

        $sequence_9 = { c706???????? 0f114604 897e14 89b5f0feffff e8???????? 8b8d24ffffff 83c40c }
            // n = 7, score = 100
            //   c706????????         |                     
            //   0f114604             | movups              xmmword ptr [esi + 4], xmm0
            //   897e14               | mov                 dword ptr [esi + 0x14], edi
            //   89b5f0feffff         | mov                 dword ptr [ebp - 0x110], esi
            //   e8????????           |                     
            //   8b8d24ffffff         | mov                 ecx, dword ptr [ebp - 0xdc]
            //   83c40c               | add                 esp, 0xc

    condition:
        7 of them and filesize < 1245184
}