rule win_decaf_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.decaf."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.decaf"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb14 488d7818 488b8c2448200000 0f1f00 e8???????? 488b8c24d0050000 48894808 }
            // n = 7, score = 100
            //   eb14                 | mov                 ebp, dword ptr [esp + 0x158]
            //   488d7818             | dec                 eax
            //   488b8c2448200000     | add                 esp, 0x160
            //   0f1f00               | ret                 
            //   e8????????           |                     
            //   488b8c24d0050000     | dec                 eax
            //   48894808             | cmp                 dword ptr [edx + 0xb0], 0

        $sequence_1 = { 488d0d69f20800 488908 488d0d02080c00 48890d???????? 833d????????00 7509 488905???????? }
            // n = 7, score = 100
            //   488d0d69f20800       | movzx               edi, byte ptr [esp + 0x95]
            //   488908               | inc                 esp
            //   488d0d02080c00       | mov                 byte ptr [esp + 0x41], bh
            //   48890d????????       |                     
            //   833d????????00       |                     
            //   7509                 | dec                 eax
            //   488905????????       |                     

        $sequence_2 = { 488d05ac221c00 bb27000000 e8???????? 488d05f3111c00 bb20000000 e8???????? 48ffc1 }
            // n = 7, score = 100
            //   488d05ac221c00       | movzx               ebp, byte ptr [esp + 0x7d]
            //   bb27000000           | inc                 esp
            //   e8????????           |                     
            //   488d05f3111c00       | mov                 byte ptr [esp + 0x50], ch
            //   bb20000000           | inc                 esp
            //   e8????????           |                     
            //   48ffc1               | movzx               ebp, byte ptr [esp + 0x81]

        $sequence_3 = { e8???????? e8???????? 4889842430110000 48899c2470020000 90 488d050a9d0c00 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   e8????????           |                     
            //   4889842430110000     | dec                 eax
            //   48899c2470020000     | mov                 ecx, dword ptr [esp + 0x1428]
            //   90                   | dec                 eax
            //   488d050a9d0c00       | lea                 edi, [0x1f3f33]
            //   e8????????           |                     

        $sequence_4 = { bb19000000 e8???????? 488d053fcd1900 bb1c000000 e8???????? 90 4889442408 }
            // n = 7, score = 100
            //   bb19000000           | cmp                 esi, eax
            //   e8????????           |                     
            //   488d053fcd1900       | jae                 0x1e84
            //   bb1c000000           | dec                 eax
            //   e8????????           |                     
            //   90                   | mov                 eax, dword ptr [esp + 0x40]
            //   4889442408           | mov                 word ptr [edi + ebx], 0xc4c2

        $sequence_5 = { e8???????? 488d0554a41400 488b5c2438 488d0d28ff1600 bf07000000 0f1f00 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488d0554a41400       | dec                 eax
            //   488b5c2438           | add                 esp, 0x28
            //   488d0d28ff1600       | dec                 eax
            //   bf07000000           | mov                 ebp, dword ptr [esp + 0x20]
            //   0f1f00               | dec                 eax
            //   e8????????           |                     

        $sequence_6 = { 663913 754e 0fb75002 66395302 7544 4889442428 48895c2430 }
            // n = 7, score = 100
            //   663913               | mov                 edi, eax
            //   754e                 | dec                 eax
            //   0fb75002             | mov                 edx, dword ptr [esp + 0xa0]
            //   66395302             | dec                 eax
            //   7544                 | lea                 edx, [0x161e45]
            //   4889442428           | dec                 eax
            //   48895c2430           | mov                 dword ptr [eax], edx

        $sequence_7 = { e8???????? 488d3de3581f00 e8???????? e8???????? 48898424f8100000 48899c24200a0000 488b0d???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488d3de3581f00       | dec                 eax
            //   e8????????           |                     
            //   e8????????           |                     
            //   48898424f8100000     | mov                 ecx, dword ptr [esp + 0xf8]
            //   48899c24200a0000     | nop                 word ptr [eax + eax]
            //   488b0d????????       |                     

        $sequence_8 = { c6041ff9 31c9 e9???????? 4983f806 754b 4c8d4301 4c39c6 }
            // n = 7, score = 100
            //   c6041ff9             | dec                 ecx
            //   31c9                 | mov                 eax, esi
            //   e9????????           |                     
            //   4983f806             | dec                 eax
            //   754b                 | mov                 ecx, ebx
            //   4c8d4301             | dec                 eax
            //   4c39c6               | mov                 ebx, eax

        $sequence_9 = { 488d6c2430 48ba059ac5d4c613bccd 4889542425 48bad4c613bccd3f86c5 4889542428 48ba46f582b1b25cdea7 488954241a }
            // n = 7, score = 100
            //   488d6c2430           | inc                 esp
            //   48ba059ac5d4c613bccd     | mov    byte ptr [esp + 0x63], ch
            //   4889542425           | inc                 esp
            //   48bad4c613bccd3f86c5     | movzx    ebp, byte ptr [esp + 0x1c2]
            //   4889542428           | inc                 esp
            //   48ba46f582b1b25cdea7     | movzx    ebp, byte ptr [esp + 0xcbe]
            //   488954241a           | inc                 esp

    condition:
        7 of them and filesize < 7193600
}