rule win_daserf_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.daserf."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { f7d2 055764eba6 96 89b42430f4ffff 8bf0 8b842430f4ffff }
            // n = 6, score = 100
            //   f7d2                 | not                 edx
            //   055764eba6           | add                 eax, 0xa6eb6457
            //   96                   | xchg                eax, esi
            //   89b42430f4ffff       | mov                 dword ptr [esp - 0xbd0], esi
            //   8bf0                 | mov                 esi, eax
            //   8b842430f4ffff       | mov                 eax, dword ptr [esp - 0xbd0]

        $sequence_1 = { 81ebec401d00 81ebf23e6175 2dfb558e1d 81c31c531c90 81eb5c20afa1 }
            // n = 5, score = 100
            //   81ebec401d00         | sub                 ebx, 0x1d40ec
            //   81ebf23e6175         | sub                 ebx, 0x75613ef2
            //   2dfb558e1d           | sub                 eax, 0x1d8e55fb
            //   81c31c531c90         | add                 ebx, 0x901c531c
            //   81eb5c20afa1         | sub                 ebx, 0xa1af205c

        $sequence_2 = { 2dfc5ddc60 81c3c57bcb30 81ebd5598ce2 2d81094125 058ded417b 2d2627935d }
            // n = 6, score = 100
            //   2dfc5ddc60           | sub                 eax, 0x60dc5dfc
            //   81c3c57bcb30         | add                 ebx, 0x30cb7bc5
            //   81ebd5598ce2         | sub                 ebx, 0xe28c59d5
            //   2d81094125           | sub                 eax, 0x25410981
            //   058ded417b           | add                 eax, 0x7b41ed8d
            //   2d2627935d           | sub                 eax, 0x5d932726

        $sequence_3 = { e8???????? 83c40c 68???????? 8d85dccfffff }
            // n = 4, score = 100
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   68????????           |                     
            //   8d85dccfffff         | lea                 eax, [ebp - 0x3024]

        $sequence_4 = { 0593f8abb9 90 0536f1718f 9b }
            // n = 4, score = 100
            //   0593f8abb9           | add                 eax, 0xb9abf893
            //   90                   | nop                 
            //   0536f1718f           | add                 eax, 0x8f71f136
            //   9b                   | wait                

        $sequence_5 = { 81c342c7a5b6 2daf2e7dff 0584b23582 0521d74246 05f3411296 2d12cffc2a }
            // n = 6, score = 100
            //   81c342c7a5b6         | add                 ebx, 0xb6a5c742
            //   2daf2e7dff           | sub                 eax, 0xff7d2eaf
            //   0584b23582           | add                 eax, 0x8235b284
            //   0521d74246           | add                 eax, 0x4642d721
            //   05f3411296           | add                 eax, 0x961241f3
            //   2d12cffc2a           | sub                 eax, 0x2afccf12

        $sequence_6 = { 81eb63386ed4 81eb7db44fc1 05c66ea7b3 81eb5c98823e 056cb152b0 058d91c6f9 }
            // n = 6, score = 100
            //   81eb63386ed4         | sub                 ebx, 0xd46e3863
            //   81eb7db44fc1         | sub                 ebx, 0xc14fb47d
            //   05c66ea7b3           | add                 eax, 0xb3a76ec6
            //   81eb5c98823e         | sub                 ebx, 0x3e82985c
            //   056cb152b0           | add                 eax, 0xb052b16c
            //   058d91c6f9           | add                 eax, 0xf9c6918d

        $sequence_7 = { ffd7 56 6a00 8945fc }
            // n = 4, score = 100
            //   ffd7                 | call                edi
            //   56                   | push                esi
            //   6a00                 | push                0
            //   8945fc               | mov                 dword ptr [ebp - 4], eax

        $sequence_8 = { 97 89bc2400f1ffff 8bf8 8b842400f1ffff }
            // n = 4, score = 100
            //   97                   | xchg                eax, edi
            //   89bc2400f1ffff       | mov                 dword ptr [esp - 0xf00], edi
            //   8bf8                 | mov                 edi, eax
            //   8b842400f1ffff       | mov                 eax, dword ptr [esp - 0xf00]

        $sequence_9 = { 50 8d868a030000 68???????? 50 e8???????? }
            // n = 5, score = 100
            //   50                   | push                eax
            //   8d868a030000         | lea                 eax, [esi + 0x38a]
            //   68????????           |                     
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_10 = { 92 89942410f1ffff 8bd0 8b842410f1ffff }
            // n = 4, score = 100
            //   92                   | xchg                eax, edx
            //   89942410f1ffff       | mov                 dword ptr [esp - 0xef0], edx
            //   8bd0                 | mov                 edx, eax
            //   8b842410f1ffff       | mov                 eax, dword ptr [esp - 0xef0]

        $sequence_11 = { 8b842420f4ffff 53 8bdb 53 }
            // n = 4, score = 100
            //   8b842420f4ffff       | mov                 eax, dword ptr [esp - 0xbe0]
            //   53                   | push                ebx
            //   8bdb                 | mov                 ebx, ebx
            //   53                   | push                ebx

        $sequence_12 = { 8bc0 8b842400f3ffff 81ebee7d857e 7500 2d444a28fe }
            // n = 5, score = 100
            //   8bc0                 | mov                 eax, eax
            //   8b842400f3ffff       | mov                 eax, dword ptr [esp - 0xd00]
            //   81ebee7d857e         | sub                 ebx, 0x7e857dee
            //   7500                 | jne                 2
            //   2d444a28fe           | sub                 eax, 0xfe284a44

        $sequence_13 = { ff75e0 8d1b ff75fc 90 }
            // n = 4, score = 100
            //   ff75e0               | push                dword ptr [ebp - 0x20]
            //   8d1b                 | lea                 ebx, [ebx]
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   90                   | nop                 

        $sequence_14 = { 81eb477bafc6 90 81eb1979d9a8 8bdb 05f1ad59f9 }
            // n = 5, score = 100
            //   81eb477bafc6         | sub                 ebx, 0xc6af7b47
            //   90                   | nop                 
            //   81eb1979d9a8         | sub                 ebx, 0xa8d97919
            //   8bdb                 | mov                 ebx, ebx
            //   05f1ad59f9           | add                 eax, 0xf959adf1

        $sequence_15 = { 81c327c3674b 2d8eee641d 81c390166ae8 05923e6fb3 05114b4947 }
            // n = 5, score = 100
            //   81c327c3674b         | add                 ebx, 0x4b67c327
            //   2d8eee641d           | sub                 eax, 0x1d64ee8e
            //   81c390166ae8         | add                 ebx, 0xe86a1690
            //   05923e6fb3           | add                 eax, 0xb36f3e92
            //   05114b4947           | add                 eax, 0x47494b11

    condition:
        7 of them and filesize < 245760
}