rule win_applejeus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.applejeus."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3945bc 727d ff7734 8b03 6a04 6800100000 03c2 }
            // n = 7, score = 100
            //   3945bc               | cmp                 dword ptr [ebp - 0x44], eax
            //   727d                 | jb                  0x7f
            //   ff7734               | push                dword ptr [edi + 0x34]
            //   8b03                 | mov                 eax, dword ptr [ebx]
            //   6a04                 | push                4
            //   6800100000           | push                0x1000
            //   03c2                 | add                 eax, edx

        $sequence_1 = { 8b048518034700 ffd0 8b75e4 83c410 0bf0 c745d8d4b24500 8d45dc }
            // n = 7, score = 100
            //   8b048518034700       | mov                 eax, dword ptr [eax*4 + 0x470318]
            //   ffd0                 | call                eax
            //   8b75e4               | mov                 esi, dword ptr [ebp - 0x1c]
            //   83c410               | add                 esp, 0x10
            //   0bf0                 | or                  esi, eax
            //   c745d8d4b24500       | mov                 dword ptr [ebp - 0x28], 0x45b2d4
            //   8d45dc               | lea                 eax, [ebp - 0x24]

        $sequence_2 = { e8???????? 8b8d44ffffff 83c40c 89853cffffff 898530ffffff c700???????? 897004 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b8d44ffffff         | mov                 ecx, dword ptr [ebp - 0xbc]
            //   83c40c               | add                 esp, 0xc
            //   89853cffffff         | mov                 dword ptr [ebp - 0xc4], eax
            //   898530ffffff         | mov                 dword ptr [ebp - 0xd0], eax
            //   c700????????         |                     
            //   897004               | mov                 dword ptr [eax + 4], esi

        $sequence_3 = { 897704 c7442418d5030000 c744241c00000000 8b17 8b7704 8b442418 2bd0 }
            // n = 7, score = 100
            //   897704               | mov                 dword ptr [edi + 4], esi
            //   c7442418d5030000     | mov                 dword ptr [esp + 0x18], 0x3d5
            //   c744241c00000000     | mov                 dword ptr [esp + 0x1c], 0
            //   8b17                 | mov                 edx, dword ptr [edi]
            //   8b7704               | mov                 esi, dword ptr [edi + 4]
            //   8b442418             | mov                 eax, dword ptr [esp + 0x18]
            //   2bd0                 | sub                 edx, eax

        $sequence_4 = { 81e100f00000 81f900300000 750b 8b4dc4 25ff0f0000 010c38 8b03 }
            // n = 7, score = 100
            //   81e100f00000         | and                 ecx, 0xf000
            //   81f900300000         | cmp                 ecx, 0x3000
            //   750b                 | jne                 0xd
            //   8b4dc4               | mov                 ecx, dword ptr [ebp - 0x3c]
            //   25ff0f0000           | and                 eax, 0xfff
            //   010c38               | add                 dword ptr [eax + edi], ecx
            //   8b03                 | mov                 eax, dword ptr [ebx]

        $sequence_5 = { 0f57c0 c745e421070000 8b45e4 3302 8902 c745e421070000 8b45e4 }
            // n = 7, score = 100
            //   0f57c0               | xorps               xmm0, xmm0
            //   c745e421070000       | mov                 dword ptr [ebp - 0x1c], 0x721
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   3302                 | xor                 eax, dword ptr [edx]
            //   8902                 | mov                 dword ptr [edx], eax
            //   c745e421070000       | mov                 dword ptr [ebp - 0x1c], 0x721
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]

        $sequence_6 = { 8955c8 e8???????? f30f7e45c4 8bf8 83c418 897de0 897dd4 }
            // n = 7, score = 100
            //   8955c8               | mov                 dword ptr [ebp - 0x38], edx
            //   e8????????           |                     
            //   f30f7e45c4           | movq                xmm0, qword ptr [ebp - 0x3c]
            //   8bf8                 | mov                 edi, eax
            //   83c418               | add                 esp, 0x18
            //   897de0               | mov                 dword ptr [ebp - 0x20], edi
            //   897dd4               | mov                 dword ptr [ebp - 0x2c], edi

        $sequence_7 = { 81f6660c0000 8902 8b4104 8930 8b4108 5e 8b00 }
            // n = 7, score = 100
            //   81f6660c0000         | xor                 esi, 0xc66
            //   8902                 | mov                 dword ptr [edx], eax
            //   8b4104               | mov                 eax, dword ptr [ecx + 4]
            //   8930                 | mov                 dword ptr [eax], esi
            //   8b4108               | mov                 eax, dword ptr [ecx + 8]
            //   5e                   | pop                 esi
            //   8b00                 | mov                 eax, dword ptr [eax]

        $sequence_8 = { c745fc00000000 c745fcf3150000 8b55fc 8b4608 81f2490f0000 8b4e04 81f2fa0a0000 }
            // n = 7, score = 100
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   c745fcf3150000       | mov                 dword ptr [ebp - 4], 0x15f3
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   81f2490f0000         | xor                 edx, 0xf49
            //   8b4e04               | mov                 ecx, dword ptr [esi + 4]
            //   81f2fa0a0000         | xor                 edx, 0xafa

        $sequence_9 = { 83f055 888575e8ffff 8b8570e8ffff 0402 83f056 888576e8ffff 8b8570e8ffff }
            // n = 7, score = 100
            //   83f055               | xor                 eax, 0x55
            //   888575e8ffff         | mov                 byte ptr [ebp - 0x178b], al
            //   8b8570e8ffff         | mov                 eax, dword ptr [ebp - 0x1790]
            //   0402                 | add                 al, 2
            //   83f056               | xor                 eax, 0x56
            //   888576e8ffff         | mov                 byte ptr [ebp - 0x178a], al
            //   8b8570e8ffff         | mov                 eax, dword ptr [ebp - 0x1790]

    condition:
        7 of them and filesize < 1245184
}