rule win_clambling_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.clambling."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clambling"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b93f000f00 ff15???????? 85c0 7527 }
            // n = 4, score = 300
            //   b93f000f00           | cmp                 eax, edi
            //   ff15????????         |                     
            //   85c0                 | jne                 0x33
            //   7527                 | dec                 esp

        $sequence_1 = { 483bc6 7504 8bc6 eb07 488d4c2440 }
            // n = 5, score = 300
            //   483bc6               | dec                 esp
            //   7504                 | mov                 eax, esi
            //   8bc6                 | dec                 eax
            //   eb07                 | lea                 edx, [0x26a18]
            //   488d4c2440           | dec                 eax

        $sequence_2 = { eb0c 211f eb08 ff15???????? }
            // n = 4, score = 300
            //   eb0c                 | dec                 esp
            //   211f                 | lea                 ecx, [esp + 0xb0]
            //   eb08                 | dec                 esp
            //   ff15????????         |                     

        $sequence_3 = { b914000000 ff15???????? b910000000 0fb7d8 ff15???????? }
            // n = 5, score = 300
            //   b914000000           | je                  0x12fb
            //   ff15????????         |                     
            //   b910000000           | dec                 eax
            //   0fb7d8               | mov                 dword ptr [eax + 0x10], esi
            //   ff15????????         |                     

        $sequence_4 = { c6401d05 ff15???????? 4c8d442460 8d5608 488bc8 ff15???????? }
            // n = 6, score = 300
            //   c6401d05             | mov                 ecx, dword ptr [esp + 0x40]
            //   ff15????????         |                     
            //   4c8d442460           | dec                 eax
            //   8d5608               | test                ecx, ecx
            //   488bc8               | je                  0x3a0
            //   ff15????????         |                     

        $sequence_5 = { 33ff 897c2430 ff15???????? 483905???????? 7510 813d????????f8010000 }
            // n = 6, score = 300
            //   33ff                 | cmp                 dword ptr [ebx + 0x158], 0
            //   897c2430             | je                  0xb8e
            //   ff15????????         |                     
            //   483905????????       |                     
            //   7510                 | dec                 eax
            //   813d????????f8010000     |     

        $sequence_6 = { 418d4802 498943f0 ff15???????? 85c0 7428 }
            // n = 5, score = 300
            //   418d4802             | mov                 dword ptr [ebx + 4], ebp
            //   498943f0             | inc                 esp
            //   ff15????????         |                     
            //   85c0                 | mov                 dword ptr [ebx + 8], esi
            //   7428                 | mov                 dword ptr [ebx], eax

        $sequence_7 = { 4c8d442460 8d5608 488bc8 ff15???????? 3bc6 0f84b5000000 }
            // n = 6, score = 300
            //   4c8d442460           | dec                 eax
            //   8d5608               | lea                 ecx, [esi + 0x40bc]
            //   488bc8               | inc                 ecx
            //   ff15????????         |                     
            //   3bc6                 | mov                 eax, 0x10
            //   0f84b5000000         | dec                 eax

        $sequence_8 = { 7408 488bcb e8???????? 488b5c2458 }
            // n = 4, score = 300
            //   7408                 | lea                 eax, [0xb0a8]
            //   488bcb               | dec                 eax
            //   e8????????           |                     
            //   488b5c2458           | cmp                 ecx, eax

        $sequence_9 = { 7524 ff15???????? 418bd7 488bcf 8bd8 ff15???????? }
            // n = 6, score = 300
            //   7524                 | dec                 esp
            //   ff15????????         |                     
            //   418bd7               | mov                 ecx, esi
            //   488bcf               | dec                 ecx
            //   8bd8                 | mov                 ecx, esp
            //   ff15????????         |                     

    condition:
        7 of them and filesize < 412672
}