rule win_diceloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.diceloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diceloader"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffc6 f73d???????? 4863ea 488bc5 48c1e004 480305???????? 3b35???????? }
            // n = 7, score = 100
            //   ffc6                 | inc                 esp
            //   f73d????????         |                     
            //   4863ea               | add                 eax, eax
            //   488bc5               | shl                 edi, 0xa
            //   48c1e004             | dec                 eax
            //   480305????????       |                     
            //   3b35????????         |                     

        $sequence_1 = { 490f45c4 4c8be0 4d85c9 740f }
            // n = 4, score = 100
            //   490f45c4             | mov                 byte ptr [ecx], dl
            //   4c8be0               | dec                 eax
            //   4d85c9               | mov                 edx, ebx
            //   740f                 | dec                 eax

        $sequence_2 = { eb47 4c897c2428 4c8d0591000000 4533c9 44897c2420 33d2 33c9 }
            // n = 7, score = 100
            //   eb47                 | dec                 ecx
            //   4c897c2428           | inc                 ebx
            //   4c8d0591000000       | cdq                 
            //   4533c9               | and                 edx, 0x3ff
            //   44897c2420           | lea                 edi, [edx + eax]
            //   33d2                 | sar                 edi, 0xa
            //   33c9                 | inc                 edi

        $sequence_3 = { 0f8416010000 83fa01 7463 448bc6 488d157a010000 488d0d8f1f0000 e8???????? }
            // n = 7, score = 100
            //   0f8416010000         | arpl                ax, ax
            //   83fa01               | inc                 edx
            //   7463                 | mov                 al, byte ptr [eax + ebx + 0x40c0]
            //   448bc6               | inc                 ecx
            //   488d157a010000       | xor                 al, byte ptr [ecx]
            //   488d0d8f1f0000       | inc                 ebx
            //   e8????????           |                     

        $sequence_4 = { f6c20f 7435 488d4808 0fb6c2 488d5b03 83e00f 4403c7 }
            // n = 7, score = 100
            //   f6c20f               | dec                 eax
            //   7435                 | arpl                si, bx
            //   488d4808             | inc                 esp
            //   0fb6c2               | cmp                 ebp, eax
            //   488d5b03             | inc                 esp
            //   83e00f               | cmovg               ebp, eax
            //   4403c7               | dec                 eax

        $sequence_5 = { ff15???????? 488b1e 4885db 7420 488b1b 498bd6 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   488b1e               | mov                 dword ptr [esi + 0x12], ebp
            //   4885db               | mov                 edx, 0xf
            //   7420                 | lea                 ecx, [edx - 0xa]
            //   488b1b               | inc                 ecx
            //   498bd6               | mov                 dword ptr [edi], eax

        $sequence_6 = { e8???????? 488d15752a0000 488bf8 488d4801 c60001 ff15???????? 66895f11 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488d15752a0000       | sar                 edx, 4
            //   488bf8               | mov                 eax, edx
            //   488d4801             | shr                 eax, 0x1f
            //   c60001               | mov                 eax, esi
            //   ff15????????         |                     
            //   66895f11             | dec                 eax

        $sequence_7 = { 4889442434 89742420 4c897c243c 4489742444 ff15???????? }
            // n = 5, score = 100
            //   4889442434           | inc                 esp
            //   89742420             | lea                 eax, [ebx + 0x1f]
            //   4c897c243c           | test                al, al
            //   4489742444           | je                  0xe6f
            //   ff15????????         |                     

        $sequence_8 = { e8???????? 498bd5 488d0dea1f0000 e8???????? }
            // n = 4, score = 100
            //   e8????????           |                     
            //   498bd5               | mov                 edi, dword ptr [esp + 0x98]
            //   488d0dea1f0000       | dec                 ecx
            //   e8????????           |                     

        $sequence_9 = { 488bda 448bc1 488d1561ffffff 488d0d761d0000 e8???????? }
            // n = 5, score = 100
            //   488bda               | add                 al, bl
            //   448bc1               | mov                 byte ptr [ebp + 0x61], al
            //   488d1561ffffff       | inc                 ebp
            //   488d0d761d0000       | xor                 esp, esp
            //   e8????????           |                     

    condition:
        7 of them and filesize < 41984
}