rule win_duqu_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.duqu."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bcb e8???????? bacdc185ad 89464c }
            // n = 4, score = 400
            //   8bcb                 | mov                 ecx, ebx
            //   e8????????           |                     
            //   bacdc185ad           | mov                 edx, 0xad85c1cd
            //   89464c               | mov                 dword ptr [esi + 0x4c], eax

        $sequence_1 = { 85f6 7eb3 b8c64ff867 8bde 8bd7 89442420 }
            // n = 6, score = 400
            //   85f6                 | test                esi, esi
            //   7eb3                 | jle                 0xffffffb5
            //   b8c64ff867           | mov                 eax, 0x67f84fc6
            //   8bde                 | mov                 ebx, esi
            //   8bd7                 | mov                 edx, edi
            //   89442420             | mov                 dword ptr [esp + 0x20], eax

        $sequence_2 = { 8b5c2414 85db 0f8402ffffff 46 }
            // n = 4, score = 400
            //   8b5c2414             | mov                 ebx, dword ptr [esp + 0x14]
            //   85db                 | test                ebx, ebx
            //   0f8402ffffff         | je                  0xffffff08
            //   46                   | inc                 esi

        $sequence_3 = { 85c0 0f848b020000 ba10ee27d3 8bcf e8???????? 894624 85c0 }
            // n = 7, score = 400
            //   85c0                 | test                eax, eax
            //   0f848b020000         | je                  0x291
            //   ba10ee27d3           | mov                 edx, 0xd327ee10
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     
            //   894624               | mov                 dword ptr [esi + 0x24], eax
            //   85c0                 | test                eax, eax

        $sequence_4 = { 0f84f7000000 0fb706 b9ab4f5ecd 33c1 }
            // n = 4, score = 400
            //   0f84f7000000         | je                  0xfd
            //   0fb706               | movzx               eax, word ptr [esi]
            //   b9ab4f5ecd           | mov                 ecx, 0xcd5e4fab
            //   33c1                 | xor                 eax, ecx

        $sequence_5 = { 56 51 8bf2 e8???????? }
            // n = 4, score = 400
            //   56                   | push                esi
            //   51                   | push                ecx
            //   8bf2                 | mov                 esi, edx
            //   e8????????           |                     

        $sequence_6 = { 83c120 0fb7c9 8bc1 0fafc9 83e007 }
            // n = 5, score = 400
            //   83c120               | add                 ecx, 0x20
            //   0fb7c9               | movzx               ecx, cx
            //   8bc1                 | mov                 eax, ecx
            //   0fafc9               | imul                ecx, ecx
            //   83e007               | and                 eax, 7

        $sequence_7 = { 85c0 7465 e8???????? 85c0 }
            // n = 4, score = 400
            //   85c0                 | test                eax, eax
            //   7465                 | je                  0x67
            //   e8????????           |                     
            //   85c0                 | test                eax, eax

        $sequence_8 = { 55 8bec 81ec08020000 56 8bf2 8d95f8fdffff }
            // n = 6, score = 400
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   81ec08020000         | sub                 esp, 0x208
            //   56                   | push                esi
            //   8bf2                 | mov                 esi, edx
            //   8d95f8fdffff         | lea                 edx, [ebp - 0x208]

        $sequence_9 = { 8bcb e8???????? bafa67937e 894648 8bcf }
            // n = 5, score = 400
            //   8bcb                 | mov                 ecx, ebx
            //   e8????????           |                     
            //   bafa67937e           | mov                 edx, 0x7e9367fa
            //   894648               | mov                 dword ptr [esi + 0x48], eax
            //   8bcf                 | mov                 ecx, edi

        $sequence_10 = { 8bf2 57 8d8e14020000 e8???????? }
            // n = 4, score = 200
            //   8bf2                 | mov                 esi, edx
            //   57                   | push                edi
            //   8d8e14020000         | lea                 ecx, [esi + 0x214]
            //   e8????????           |                     

        $sequence_11 = { 8bf2 57 8d4e4c e8???????? }
            // n = 4, score = 200
            //   8bf2                 | mov                 esi, edx
            //   57                   | push                edi
            //   8d4e4c               | lea                 ecx, [esi + 0x4c]
            //   e8????????           |                     

        $sequence_12 = { 8bf2 8bf9 ff15???????? 56 }
            // n = 4, score = 200
            //   8bf2                 | mov                 esi, edx
            //   8bf9                 | mov                 edi, ecx
            //   ff15????????         |                     
            //   56                   | push                esi

        $sequence_13 = { 8bf2 57 8d8ecc000000 e8???????? }
            // n = 4, score = 200
            //   8bf2                 | mov                 esi, edx
            //   57                   | push                edi
            //   8d8ecc000000         | lea                 ecx, [esi + 0xcc]
            //   e8????????           |                     

        $sequence_14 = { 8bf2 57 8d8e0c020000 e8???????? }
            // n = 4, score = 200
            //   8bf2                 | mov                 esi, edx
            //   57                   | push                edi
            //   8d8e0c020000         | lea                 ecx, [esi + 0x20c]
            //   e8????????           |                     

        $sequence_15 = { 8bf2 57 8bf9 85f6 7425 66833e00 }
            // n = 6, score = 200
            //   8bf2                 | mov                 esi, edx
            //   57                   | push                edi
            //   8bf9                 | mov                 edi, ecx
            //   85f6                 | test                esi, esi
            //   7425                 | je                  0x27
            //   66833e00             | cmp                 word ptr [esi], 0

    condition:
        7 of them and filesize < 18759680
}