rule win_applejeus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-05-30"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus"
        malpedia_rule_date = "20200529"
        malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8"
        malpedia_version = "20200529"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c745ec00000000 8938 c745fc00000000 8b7304 c745c400000000 c745c800000000 c745cc00000000 }
            // n = 7, score = 100
            //   c745ec00000000       | mov                 dword ptr [ebp - 0x14], 0
            //   8938                 | mov                 dword ptr [eax], edi
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   8b7304               | mov                 esi, dword ptr [ebx + 4]
            //   c745c400000000       | mov                 dword ptr [ebp - 0x3c], 0
            //   c745c800000000       | mov                 dword ptr [ebp - 0x38], 0
            //   c745cc00000000       | mov                 dword ptr [ebp - 0x34], 0

        $sequence_1 = { 33c8 888c1564f6ffff 42 83fa73 72df c685d7f6ffff00 8d8d64f6ffff }
            // n = 7, score = 100
            //   33c8                 | xor                 ecx, eax
            //   888c1564f6ffff       | mov                 byte ptr [ebp + edx - 0x99c], cl
            //   42                   | inc                 edx
            //   83fa73               | cmp                 edx, 0x73
            //   72df                 | jb                  0xffffffe1
            //   c685d7f6ffff00       | mov                 byte ptr [ebp - 0x929], 0
            //   8d8d64f6ffff         | lea                 ecx, [ebp - 0x99c]

        $sequence_2 = { c745e400000000 8b410c 50 6a00 51 8b04856cfc4600 ffd0 }
            // n = 7, score = 100
            //   c745e400000000       | mov                 dword ptr [ebp - 0x1c], 0
            //   8b410c               | mov                 eax, dword ptr [ecx + 0xc]
            //   50                   | push                eax
            //   6a00                 | push                0
            //   51                   | push                ecx
            //   8b04856cfc4600       | mov                 eax, dword ptr [eax*4 + 0x46fc6c]
            //   ffd0                 | call                eax

        $sequence_3 = { 0f1f840000000000 8a841570e7ffff 0fbe8d6ce7ffff 0fbec0 33c1 88841570e7ffff 42 }
            // n = 7, score = 100
            //   0f1f840000000000     | nop                 dword ptr [eax + eax]
            //   8a841570e7ffff       | mov                 al, byte ptr [ebp + edx - 0x1890]
            //   0fbe8d6ce7ffff       | movsx               ecx, byte ptr [ebp - 0x1894]
            //   0fbec0               | movsx               eax, al
            //   33c1                 | xor                 eax, ecx
            //   88841570e7ffff       | mov                 byte ptr [ebp + edx - 0x1890], al
            //   42                   | inc                 edx

        $sequence_4 = { 0420 83f064 8885ace8ffff 8b8588e8ffff 0421 83f061 8885ade8ffff }
            // n = 7, score = 100
            //   0420                 | add                 al, 0x20
            //   83f064               | xor                 eax, 0x64
            //   8885ace8ffff         | mov                 byte ptr [ebp - 0x1754], al
            //   8b8588e8ffff         | mov                 eax, dword ptr [ebp - 0x1778]
            //   0421                 | add                 al, 0x21
            //   83f061               | xor                 eax, 0x61
            //   8885ade8ffff         | mov                 byte ptr [ebp - 0x1753], al

        $sequence_5 = { 6a08 e8???????? 8d8de4f7ffff 8985e4f6ffff 83c404 898580f4ffff }
            // n = 6, score = 100
            //   6a08                 | push                8
            //   e8????????           |                     
            //   8d8de4f7ffff         | lea                 ecx, [ebp - 0x81c]
            //   8985e4f6ffff         | mov                 dword ptr [ebp - 0x91c], eax
            //   83c404               | add                 esp, 4
            //   898580f4ffff         | mov                 dword ptr [ebp - 0xb80], eax

        $sequence_6 = { c68568fbffff2a c68569fbffff24 c6856afbffff05 88856bfbffff 8a8560fbffff 6690 }
            // n = 6, score = 100
            //   c68568fbffff2a       | mov                 byte ptr [ebp - 0x498], 0x2a
            //   c68569fbffff24       | mov                 byte ptr [ebp - 0x497], 0x24
            //   c6856afbffff05       | mov                 byte ptr [ebp - 0x496], 5
            //   88856bfbffff         | mov                 byte ptr [ebp - 0x495], al
            //   8a8560fbffff         | mov                 al, byte ptr [ebp - 0x4a0]
            //   6690                 | nop                 

        $sequence_7 = { c7470400000000 e8???????? 8d442410 897c2410 50 e8???????? 8b742410 }
            // n = 7, score = 100
            //   c7470400000000       | mov                 dword ptr [edi + 4], 0
            //   e8????????           |                     
            //   8d442410             | lea                 eax, [esp + 0x10]
            //   897c2410             | mov                 dword ptr [esp + 0x10], edi
            //   50                   | push                eax
            //   e8????????           |                     
            //   8b742410             | mov                 esi, dword ptr [esp + 0x10]

        $sequence_8 = { e9???????? 8d8d5ce7ffff e9???????? 8d8d70e9ffff e9???????? 8d8d50e7ffff e9???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   8d8d5ce7ffff         | lea                 ecx, [ebp - 0x18a4]
            //   e9????????           |                     
            //   8d8d70e9ffff         | lea                 ecx, [ebp - 0x1690]
            //   e9????????           |                     
            //   8d8d50e7ffff         | lea                 ecx, [ebp - 0x18b0]
            //   e9????????           |                     

        $sequence_9 = { c645fc03 e8???????? 8945e4 8945d4 c700???????? 897004 c645fc04 }
            // n = 7, score = 100
            //   c645fc03             | mov                 byte ptr [ebp - 4], 3
            //   e8????????           |                     
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax
            //   8945d4               | mov                 dword ptr [ebp - 0x2c], eax
            //   c700????????         |                     
            //   897004               | mov                 dword ptr [eax + 4], esi
            //   c645fc04             | mov                 byte ptr [ebp - 4], 4

    condition:
        7 of them and filesize < 1245184
}