rule win_confucius_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.confucius."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.confucius"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff7510 57 ff7508 ff15???????? 8bf8 83ffff 74de }
            // n = 7, score = 100
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   57                   | push                edi
            //   ff7508               | push                dword ptr [ebp + 8]
            //   ff15????????         |                     
            //   8bf8                 | mov                 edi, eax
            //   83ffff               | cmp                 edi, -1
            //   74de                 | je                  0xffffffe0

        $sequence_1 = { 0f8464010000 80392f 0f855b010000 8b8048030000 6a04 50 68???????? }
            // n = 7, score = 100
            //   0f8464010000         | je                  0x16a
            //   80392f               | cmp                 byte ptr [ecx], 0x2f
            //   0f855b010000         | jne                 0x161
            //   8b8048030000         | mov                 eax, dword ptr [eax + 0x348]
            //   6a04                 | push                4
            //   50                   | push                eax
            //   68????????           |                     

        $sequence_2 = { 50 e8???????? 8b4c243c 83c410 2bc8 85c9 0f8e94050000 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   e8????????           |                     
            //   8b4c243c             | mov                 ecx, dword ptr [esp + 0x3c]
            //   83c410               | add                 esp, 0x10
            //   2bc8                 | sub                 ecx, eax
            //   85c9                 | test                ecx, ecx
            //   0f8e94050000         | jle                 0x59a

        $sequence_3 = { 7c1e 7f04 3bcb 7618 68???????? 56 e8???????? }
            // n = 7, score = 100
            //   7c1e                 | jl                  0x20
            //   7f04                 | jg                  6
            //   3bcb                 | cmp                 ecx, ebx
            //   7618                 | jbe                 0x1a
            //   68????????           |                     
            //   56                   | push                esi
            //   e8????????           |                     

        $sequence_4 = { 0f85ed010000 eb3e 8305????????ff 8315????????ff 781b 7f09 833d????????00 }
            // n = 7, score = 100
            //   0f85ed010000         | jne                 0x1f3
            //   eb3e                 | jmp                 0x40
            //   8305????????ff       |                     
            //   8315????????ff       |                     
            //   781b                 | js                  0x1d
            //   7f09                 | jg                  0xb
            //   833d????????00       |                     

        $sequence_5 = { e8???????? 8bc3 5f 5e 5b 83c578 c9 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8bc3                 | mov                 eax, ebx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   83c578               | add                 ebp, 0x78
            //   c9                   | leave               

        $sequence_6 = { 5e c9 c20800 ff742404 e8???????? 50 68???????? }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   c9                   | leave               
            //   c20800               | ret                 8
            //   ff742404             | push                dword ptr [esp + 4]
            //   e8????????           |                     
            //   50                   | push                eax
            //   68????????           |                     

        $sequence_7 = { 59 c3 8bcd 8bf8 8bd1 c1e902 f3a5 }
            // n = 7, score = 100
            //   59                   | pop                 ecx
            //   c3                   | ret                 
            //   8bcd                 | mov                 ecx, ebp
            //   8bf8                 | mov                 edi, eax
            //   8bd1                 | mov                 edx, ecx
            //   c1e902               | shr                 ecx, 2
            //   f3a5                 | rep movsd           dword ptr es:[edi], dword ptr [esi]

        $sequence_8 = { 57 56 8b7e2c 33ed 8b07 8b9fc8000000 89442418 }
            // n = 7, score = 100
            //   57                   | push                edi
            //   56                   | push                esi
            //   8b7e2c               | mov                 edi, dword ptr [esi + 0x2c]
            //   33ed                 | xor                 ebp, ebp
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   8b9fc8000000         | mov                 ebx, dword ptr [edi + 0xc8]
            //   89442418             | mov                 dword ptr [esp + 0x18], eax

        $sequence_9 = { 740f 8d4518 50 8d8d74ffffff e8???????? 391d???????? 7416 }
            // n = 7, score = 100
            //   740f                 | je                  0x11
            //   8d4518               | lea                 eax, dword ptr [ebp + 0x18]
            //   50                   | push                eax
            //   8d8d74ffffff         | lea                 ecx, dword ptr [ebp - 0x8c]
            //   e8????????           |                     
            //   391d????????         |                     
            //   7416                 | je                  0x18

        $sequence_10 = { 6683f809 7724 e8???????? a1???????? 8b0d???????? 8901 a1???????? }
            // n = 7, score = 100
            //   6683f809             | cmp                 ax, 9
            //   7724                 | ja                  0x26
            //   e8????????           |                     
            //   a1????????           |                     
            //   8b0d????????         |                     
            //   8901                 | mov                 dword ptr [ecx], eax
            //   a1????????           |                     

        $sequence_11 = { 5b c3 51 53 55 8b6c2414 32db }
            // n = 7, score = 100
            //   5b                   | pop                 ebx
            //   c3                   | ret                 
            //   51                   | push                ecx
            //   53                   | push                ebx
            //   55                   | push                ebp
            //   8b6c2414             | mov                 ebp, dword ptr [esp + 0x14]
            //   32db                 | xor                 bl, bl

        $sequence_12 = { 25ff000000 ebe1 6a04 6a00 ff74240c e8???????? 83c40c }
            // n = 7, score = 100
            //   25ff000000           | and                 eax, 0xff
            //   ebe1                 | jmp                 0xffffffe3
            //   6a04                 | push                4
            //   6a00                 | push                0
            //   ff74240c             | push                dword ptr [esp + 0xc]
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_13 = { 50 e8???????? eb09 33c0 6689861e040000 8d461d }
            // n = 6, score = 100
            //   50                   | push                eax
            //   e8????????           |                     
            //   eb09                 | jmp                 0xb
            //   33c0                 | xor                 eax, eax
            //   6689861e040000       | mov                 word ptr [esi + 0x41e], ax
            //   8d461d               | lea                 eax, dword ptr [esi + 0x1d]

        $sequence_14 = { 68???????? 50 e8???????? 85c0 7411 68???????? }
            // n = 6, score = 100
            //   68????????           |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7411                 | je                  0x13
            //   68????????           |                     

        $sequence_15 = { 5e 5b c3 8b03 c70000000000 c7400400000000 8b8f84010000 }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c3                   | ret                 
            //   8b03                 | mov                 eax, dword ptr [ebx]
            //   c70000000000         | mov                 dword ptr [eax], 0
            //   c7400400000000       | mov                 dword ptr [eax + 4], 0
            //   8b8f84010000         | mov                 ecx, dword ptr [edi + 0x184]

    condition:
        7 of them and filesize < 598016
}