rule win_burnbook_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.burnbook."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.burnbook"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 4c8b4b10 4c8bc3 488bd6 488bcf e8???????? 488bcf }
            // n = 7, score = 200
            //   e8????????           |                     
            //   4c8b4b10             | shl                 eax, 7
            //   4c8bc3               | dec                 eax
            //   488bd6               | mov                 edx, dword ptr [eax + edx + 0x68]
            //   488bcf               | dec                 eax
            //   e8????????           |                     
            //   488bcf               | arpl                word ptr [edi + 0x11c], dx

        $sequence_1 = { f30f11442438 4c8bcd f30f11442430 4d8bc6 48895c2428 488bd6 48897c2420 }
            // n = 7, score = 200
            //   f30f11442438         | dec                 eax
            //   4c8bcd               | mov                 ecx, edi
            //   f30f11442430         | dec                 eax
            //   4d8bc6               | cmp                 eax, 0x1f1
            //   48895c2428           | jb                  0x972
            //   488bd6               | cmp                 byte ptr [eax + 2], 0x73
            //   48897c2420           | jne                 0x972

        $sequence_2 = { ff5310 488bc8 4885c0 747d c70037000000 896804 48897810 }
            // n = 7, score = 200
            //   ff5310               | dec                 eax
            //   488bc8               | mov                 edi, ecx
            //   4885c0               | dec                 esp
            //   747d                 | mov                 eax, ebp
            //   c70037000000         | dec                 eax
            //   896804               | mov                 edx, ebx
            //   48897810             | dec                 eax

        $sequence_3 = { ffc6 4883c308 83fe03 72d5 488d542420 488bcd e8???????? }
            // n = 7, score = 200
            //   ffc6                 | mov                 edx, 1
            //   4883c308             | dec                 ecx
            //   83fe03               | mov                 ecx, ecx
            //   72d5                 | dec                 eax
            //   488d542420           | mov                 esi, ecx
            //   488bcd               | inc                 ecx
            //   e8????????           |                     

        $sequence_4 = { f30f59cd f30f58d4 f30f11590c f30f58c8 f3410f585014 f3410f584810 f30f115114 }
            // n = 7, score = 200
            //   f30f59cd             | dec                 eax
            //   f30f58d4             | mov                 ecx, edi
            //   f30f11590c           | mov                 ebx, eax
            //   f30f58c8             | cmp                 ebx, eax
            //   f3410f585014         | jne                 0x1f10
            //   f3410f584810         | inc                 esp
            //   f30f115114           | mov                 eax, dword ptr [esp + 0x98]

        $sequence_5 = { f30f10442444 488bd6 0f5adb 488bcf 0f5ac0 66490f7ed9 f20f11442420 }
            // n = 7, score = 200
            //   f30f10442444         | bt                  edi, 0xc
            //   488bd6               | jae                 0x10d9
            //   0f5adb               | dec                 eax
            //   488bcf               | mov                 ecx, dword ptr [ebp - 0x60]
            //   0f5ac0               | btr                 edi, 0xc
            //   66490f7ed9           | dec                 eax
            //   f20f11442420         | mov                 edx, eax

        $sequence_6 = { ff10 48897588 488d4c2470 e8???????? 488d4c2428 e8???????? 40387540 }
            // n = 7, score = 200
            //   ff10                 | mov                 ecx, 4
            //   48897588             | dec                 esi
            //   488d4c2470           | mov                 eax, dword ptr [eax + eax*8]
            //   e8????????           |                     
            //   488d4c2428           | inc                 edx
            //   e8????????           |                     
            //   40387540             | mov                 eax, dword ptr [ecx + eax]

        $sequence_7 = { f00fc17808 83ff01 750d 488b8c2490000000 e8???????? 488b742430 458bcc }
            // n = 7, score = 200
            //   f00fc17808           | dec                 eax
            //   83ff01               | mov                 ecx, edi
            //   750d                 | dec                 eax
            //   488b8c2490000000     | mov                 ecx, esi
            //   e8????????           |                     
            //   488b742430           | dec                 eax
            //   458bcc               | mov                 esi, dword ptr [esp + 0x70]

        $sequence_8 = { f2410f58c8 f20f118c24c8000000 8b8424c8000000 c1f810 664103c4 440fb7c0 488bd5 }
            // n = 7, score = 200
            //   f2410f58c8           | dec                 eax
            //   f20f118c24c8000000     | mov    dword ptr [esp + 0x78], ebp
            //   8b8424c8000000       | dec                 eax
            //   c1f810               | test                ecx, ecx
            //   664103c4             | je                  0x5bf
            //   440fb7c0             | dec                 eax
            //   488bd5               | mov                 edx, eax

        $sequence_9 = { f2440f104c2440 f2440f5c4c2458 f20f1000 f20f1035???????? 0f57c6 f2440f59c8 f2440f5ecf }
            // n = 7, score = 200
            //   f2440f104c2440       | mov                 edx, eax
            //   f2440f5c4c2458       | dec                 eax
            //   f20f1000             | mov                 ecx, esi
            //   f20f1035????????     |                     
            //   0f57c6               | dec                 esp
            //   f2440f59c8           | mov                 ebp, eax
            //   f2440f5ecf           | inc                 ebp

    condition:
        7 of them and filesize < 22976512
}