rule win_duqu_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ba0b7bb6ba 894604 8bcb e8???????? }
            // n = 4, score = 400
            //   ba0b7bb6ba           | mov                 edx, 0xbab67b0b
            //   894604               | mov                 dword ptr [esi + 4], eax
            //   8bcb                 | mov                 ecx, ebx
            //   e8????????           |                     

        $sequence_1 = { e8???????? 85c0 7465 e8???????? 85c0 }
            // n = 5, score = 400
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7465                 | je                  0x67
            //   e8????????           |                     
            //   85c0                 | test                eax, eax

        $sequence_2 = { 5b c9 51 c3 b8???????? c3 55 }
            // n = 7, score = 400
            //   5b                   | pop                 ebx
            //   c9                   | leave               
            //   51                   | push                ecx
            //   c3                   | ret                 
            //   b8????????           |                     
            //   c3                   | ret                 
            //   55                   | push                ebp

        $sequence_3 = { 56 51 8bf2 e8???????? }
            // n = 4, score = 400
            //   56                   | push                esi
            //   51                   | push                ecx
            //   8bf2                 | mov                 esi, edx
            //   e8????????           |                     

        $sequence_4 = { 7703 83c120 0fb7c9 8bc1 0fafc9 }
            // n = 5, score = 400
            //   7703                 | ja                  5
            //   83c120               | add                 ecx, 0x20
            //   0fb7c9               | movzx               ecx, cx
            //   8bc1                 | mov                 eax, ecx
            //   0fafc9               | imul                ecx, ecx

        $sequence_5 = { 668902 c3 8b01 56 57 bff186f186 33f6 }
            // n = 7, score = 400
            //   668902               | mov                 word ptr [edx], ax
            //   c3                   | ret                 
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   56                   | push                esi
            //   57                   | push                edi
            //   bff186f186           | mov                 edi, 0x86f186f1
            //   33f6                 | xor                 esi, esi

        $sequence_6 = { 89442438 33c0 8944241c 394218 0f8697000000 }
            // n = 5, score = 400
            //   89442438             | mov                 dword ptr [esp + 0x38], eax
            //   33c0                 | xor                 eax, eax
            //   8944241c             | mov                 dword ptr [esp + 0x1c], eax
            //   394218               | cmp                 dword ptr [edx + 0x18], eax
            //   0f8697000000         | jbe                 0x9d

        $sequence_7 = { 5b c3 55 8bec 81ec08020000 56 8bf2 }
            // n = 7, score = 400
            //   5b                   | pop                 ebx
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   81ec08020000         | sub                 esp, 0x208
            //   56                   | push                esi
            //   8bf2                 | mov                 esi, edx

        $sequence_8 = { 8bcf e8???????? ba36442dba 89868c000000 8bcb e8???????? ba09bfeee9 }
            // n = 7, score = 400
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     
            //   ba36442dba           | mov                 edx, 0xba2d4436
            //   89868c000000         | mov                 dword ptr [esi + 0x8c], eax
            //   8bcb                 | mov                 ecx, ebx
            //   e8????????           |                     
            //   ba09bfeee9           | mov                 edx, 0xe9eebf09

        $sequence_9 = { 8b03 8b5378 33c1 03d6 3dfb0a5ecd 0f85c5000000 }
            // n = 6, score = 400
            //   8b03                 | mov                 eax, dword ptr [ebx]
            //   8b5378               | mov                 edx, dword ptr [ebx + 0x78]
            //   33c1                 | xor                 eax, ecx
            //   03d6                 | add                 edx, esi
            //   3dfb0a5ecd           | cmp                 eax, 0xcd5e0afb
            //   0f85c5000000         | jne                 0xcb

        $sequence_10 = { 3b7df4 7e34 ff7518 8b45f4 6a02 }
            // n = 5, score = 200
            //   3b7df4               | cmp                 edi, dword ptr [ebp - 0xc]
            //   7e34                 | jle                 0x36
            //   ff7518               | push                dword ptr [ebp + 0x18]
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   6a02                 | push                2

        $sequence_11 = { 56 57 33ff 6828020000 8d85d8fdffff }
            // n = 5, score = 200
            //   56                   | push                esi
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi
            //   6828020000           | push                0x228
            //   8d85d8fdffff         | lea                 eax, [ebp - 0x228]

        $sequence_12 = { ff15???????? 3b05???????? 7408 8975fc a3???????? }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   3b05????????         |                     
            //   7408                 | je                  0xa
            //   8975fc               | mov                 dword ptr [ebp - 4], esi
            //   a3????????           |                     

        $sequence_13 = { 85c0 7514 8d86a4000000 50 }
            // n = 4, score = 200
            //   85c0                 | test                eax, eax
            //   7514                 | jne                 0x16
            //   8d86a4000000         | lea                 eax, [esi + 0xa4]
            //   50                   | push                eax

        $sequence_14 = { 8918 8b5904 895804 8b45fc }
            // n = 4, score = 200
            //   8918                 | mov                 dword ptr [eax], ebx
            //   8b5904               | mov                 ebx, dword ptr [ecx + 4]
            //   895804               | mov                 dword ptr [eax + 4], ebx
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_15 = { 8d85d4fdffff 50 53 c785d4fdffff2c020000 e8???????? }
            // n = 5, score = 200
            //   8d85d4fdffff         | lea                 eax, [ebp - 0x22c]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   c785d4fdffff2c020000     | mov    dword ptr [ebp - 0x22c], 0x22c
            //   e8????????           |                     

    condition:
        7 of them and filesize < 18759680
}