rule win_blind_edr_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.blind_edr."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blind_edr"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 488b4c2458 488d542468 4883c108 48897c2468 4533c9 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   488b4c2458           | mov                 ebx, 1
            //   488d542468           | mov                 dword ptr [esp + 0x20], ebx
            //   4883c108             | jmp                 0x48f
            //   48897c2468           | test                eax, eax
            //   4533c9               | jne                 0x48a

        $sequence_1 = { 33f6 b918000000 e8???????? 488bd8 }
            // n = 4, score = 100
            //   33f6                 | xor                 eax, eax
            //   b918000000           | dec                 eax
            //   e8????????           |                     
            //   488bd8               | lea                 ecx, [ebx + ebx*4]

        $sequence_2 = { 7525 3df4650000 7508 41bd40010000 eb25 3d5d580000 b930010000 }
            // n = 7, score = 100
            //   7525                 | dec                 eax
            //   3df4650000           | lea                 ecx, [0x1c096]
            //   7508                 | test                eax, eax
            //   41bd40010000         | je                  0x6c
            //   eb25                 | xor                 al, al
            //   3d5d580000           | jmp                 0x75
            //   b930010000           | jne                 0x55

        $sequence_3 = { 89842470010000 418b7720 418b6f24 4803f1 418b4f1c 4903ee }
            // n = 6, score = 100
            //   89842470010000       | dec                 eax
            //   418b7720             | lea                 ecx, [0x120f0]
            //   418b6f24             | dec                 eax
            //   4803f1               | lea                 eax, [0x11da2]
            //   418b4f1c             | dec                 eax
            //   4903ee               | lea                 ecx, [0x11fcb]

        $sequence_4 = { 488bd9 4c8d0dbcfd0000 33c9 4c8d05abfd0000 488d15acfd0000 e8???????? 4885c0 }
            // n = 7, score = 100
            //   488bd9               | inc                 ecx
            //   4c8d0dbcfd0000       | dec                 eax
            //   33c9                 | inc                 edx
            //   4c8d05abfd0000       | dec                 eax
            //   488d15acfd0000       | mov                 ecx, edi
            //   e8????????           |                     
            //   4885c0               | dec                 esp

        $sequence_5 = { 4c8d0d069f0000 c5f35cca c4c173590cc1 4c8d0dd58e0000 c5f359c1 }
            // n = 5, score = 100
            //   4c8d0d069f0000       | movsd               xmm2, qword ptr [edx + eax*8]
            //   c5f35cca             | vaddsd              xmm2, xmm2, xmm5
            //   c4c173590cc1         | vaddsd              xmm0, xmm0, xmm2
            //   4c8d0dd58e0000       | dec                 eax
            //   c5f359c1             | lea                 edx, [0x11792]

        $sequence_6 = { 4883c110 48897538 4533c9 41b808000000 e8???????? 488b4538 ffc3 }
            // n = 7, score = 100
            //   4883c110             | mov                 dword ptr [ebp + 0x30], esi
            //   48897538             | inc                 ebp
            //   4533c9               | xor                 ecx, ecx
            //   41b808000000         | dec                 eax
            //   e8????????           |                     
            //   488b4538             | add                 esi, ecx
            //   ffc3                 | inc                 ecx

        $sequence_7 = { 488bd0 488bc8 482bd3 33c0 }
            // n = 4, score = 100
            //   488bd0               | xor                 eax, eax
            //   488bc8               | dec                 eax
            //   482bd3               | mov                 ebx, dword ptr [esp + 0x30]
            //   33c0                 | dec                 eax

        $sequence_8 = { 4885c0 0f849b000000 4889742430 488d0d3d0e0100 c744242880000000 }
            // n = 5, score = 100
            //   4885c0               | inc                 ecx
            //   0f849b000000         | jmp                 ecx
            //   4889742430           | dec                 esp
            //   488d0d3d0e0100       | mov                 dword ptr [ecx - 0xf], ebx
            //   c744242880000000     | inc                 esp

        $sequence_9 = { 4885d2 0f847d000000 488b442448 4c8d0dfabf0100 418bce 41b801000000 }
            // n = 6, score = 100
            //   4885d2               | dec                 eax
            //   0f847d000000         | lea                 ecx, [esp + 0x20]
            //   488b442448           | dec                 eax
            //   4c8d0dfabf0100       | add                 ebx, 7
            //   418bce               | dec                 eax
            //   41b801000000         | add                 ebx, eax

    condition:
        7 of them and filesize < 299008
}