rule win_enigma_loader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.enigma_loader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enigma_loader"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b05???????? 33ff 66393d???????? 41bc09cb3d8d 0f1145ea 8945fa 448d770a }
            // n = 7, score = 100
            //   8b05????????         |                     
            //   33ff                 | and                 ecx, 0xf
            //   66393d????????       |                     
            //   41bc09cb3d8d         | dec                 edx
            //   0f1145ea             | movsx               eax, byte ptr [ecx + esi + 0x29478]
            //   8945fa               | inc                 edx
            //   448d770a             | mov                 cl, byte ptr [ecx + esi + 0x29488]

        $sequence_1 = { 0f840c010000 488b01 4c8d4de0 4c8d4520 488d5530 ff5010 84c0 }
            // n = 7, score = 100
            //   0f840c010000         | mov                 ecx, esi
            //   488b01               | inc                 ebp
            //   4c8d4de0             | xor                 ecx, ecx
            //   4c8d4520             | mov                 dword ptr [esp + 0x20], ebx
            //   488d5530             | inc                 ebp
            //   ff5010               | xor                 eax, eax
            //   84c0                 | dec                 eax

        $sequence_2 = { e9???????? 488b8aa0000000 4883c108 e9???????? 488b8aa0000000 4883c120 e9???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   488b8aa0000000       | mov                 ebx, 0x1ce43de8
            //   4883c108             | mov                 edx, ebx
            //   e9????????           |                     
            //   488b8aa0000000       | dec                 eax
            //   4883c120             | mov                 ecx, edi
            //   e9????????           |                     

        $sequence_3 = { 488d542478 488bcf e8???????? 90 41c6466801 4138b6b0000000 0f85e2040000 }
            // n = 7, score = 100
            //   488d542478           | mov                 eax, dword ptr [ecx + eax*8]
            //   488bcf               | dec                 ebx
            //   e8????????           |                     
            //   90                   | lea                 edx, [edx + edx*8]
            //   41c6466801           | dec                 eax
            //   4138b6b0000000       | lea                 ecx, [0xfffe7c3c]
            //   0f85e2040000         | dec                 eax

        $sequence_4 = { 488d05dfab0200 e9???????? 488d0523ac0200 eb7c 488d056aac0200 eb73 }
            // n = 6, score = 100
            //   488d05dfab0200       | mov                 dword ptr [ecx + 8], ebx
            //   e9????????           |                     
            //   488d0523ac0200       | dec                 eax
            //   eb7c                 | mov                 ecx, dword ptr [esi + 0x20]
            //   488d056aac0200       | mov                 dl, byte ptr [ecx]
            //   eb73                 | mov                 byte ptr [ecx], 5

        $sequence_5 = { 498b4210 448b10 410fb609 83e10f 4a0fbe843178940200 428a8c3188940200 4c2bc8 }
            // n = 7, score = 100
            //   498b4210             | lea                 ecx, [ebp - 0x80]
            //   448b10               | call                eax
            //   410fb609             | mov                 ebx, 5
            //   83e10f               | mov                 edx, 0xdc75ff2d
            //   4a0fbe843178940200     | inc    ecx
            //   428a8c3188940200     | mov                 ecx, ebp
            //   4c2bc8               | inc                 ebp

        $sequence_6 = { 4d8b86c8000000 4c898558020000 488b4610 48394608 7529 488b0e 8a11 }
            // n = 7, score = 100
            //   4d8b86c8000000       | dec                 eax
            //   4c898558020000       | lea                 edx, [ebp + 0x7f]
            //   488b4610             | dec                 ecx
            //   48394608             | mov                 ecx, esi
            //   7529                 | call                eax
            //   488b0e               | dec                 eax
            //   8a11                 | mov                 edi, eax

        $sequence_7 = { cc 33c0 4c8d1d8fbafeff 884118 0f57c0 }
            // n = 5, score = 100
            //   cc                   | mov                 eax, esi
            //   33c0                 | dec                 eax
            //   4c8d1d8fbafeff       | mov                 dword ptr [esp + 0x20], eax
            //   884118               | dec                 eax
            //   0f57c0               | lea                 edx, [0x247df]

        $sequence_8 = { 33d2 33c9 ffd0 4889842420010000 4885c0 7510 bab9fa0e75 }
            // n = 7, score = 100
            //   33d2                 | call                eax
            //   33c9                 | mov                 ebx, eax
            //   ffd0                 | jmp                 0xacd
            //   4889842420010000     | dec                 eax
            //   4885c0               | mov                 ecx, edx
            //   7510                 | mov                 esi, eax
            //   bab9fa0e75           | mov                 ebp, eax

        $sequence_9 = { 773b 498bc8 e8???????? 488b6c2458 4a8d0ce3 48891f 498bc6 }
            // n = 7, score = 100
            //   773b                 | jmp                 0x120
            //   498bc8               | je                  0x146
            //   e8????????           |                     
            //   488b6c2458           | sub                 ecx, 1
            //   4a8d0ce3             | je                  0x146
            //   48891f               | sub                 ecx, 1
            //   498bc6               | je                  0x146

    condition:
        7 of them and filesize < 798720
}