rule win_flame_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.flame."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flame"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 741a 83f901 7415 e8???????? c70016000000 e8???????? 83c8ff }
            // n = 7, score = 400
            //   741a                 | je                  0x1c
            //   83f901               | cmp                 ecx, 1
            //   7415                 | je                  0x17
            //   e8????????           |                     
            //   c70016000000         | mov                 dword ptr [eax], 0x16
            //   e8????????           |                     
            //   83c8ff               | or                  eax, 0xffffffff

        $sequence_1 = { 8bec 56 8b750c 2b7508 56 ff7508 }
            // n = 6, score = 200
            //   8bec                 | add                 eax, 0xebd0b70f
            //   56                   | je                  0x66
            //   8b750c               | dec                 eax
            //   2b7508               | lea                 eax, [ebp - 0x20]
            //   56                   | dec                 eax
            //   ff7508               | lea                 edx, [ebp - 0x30]

        $sequence_2 = { 8945fc 6800010000 8d85ecfeffff 53 50 e8???????? be???????? }
            // n = 7, score = 200
            //   8945fc               | test                ecx, ecx
            //   6800010000           | je                  0x1e
            //   8d85ecfeffff         | cmp                 ecx, 1
            //   53                   | je                  0x1a
            //   50                   | mov                 dword ptr [eax], 0x16
            //   e8????????           |                     
            //   be????????           |                     

        $sequence_3 = { 745e 4c8b01 45397848 7555 }
            // n = 4, score = 200
            //   745e                 | mov                 eax, dword ptr [ebp - 0x68]
            //   4c8b01               | inc                 ebp
            //   45397848             | test                esi, esi
            //   7555                 | je                  0x24

        $sequence_4 = { 745d 448b4598 4585f6 741b }
            // n = 4, score = 200
            //   745d                 | je                  0x5c
            //   448b4598             | dec                 eax
            //   4585f6               | arpl                dx, ax
            //   741b                 | inc                 ecx

        $sequence_5 = { 745a 448bcf 4c8bc6 488d542458 488b0b e8???????? }
            // n = 6, score = 200
            //   745a                 | je                  0x5c
            //   448bcf               | inc                 esp
            //   4c8bc6               | mov                 ecx, edi
            //   488d542458           | dec                 esp
            //   488b0b               | mov                 eax, esi
            //   e8????????           |                     

        $sequence_6 = { 7460 8b4028 4533c0 418bd5 }
            // n = 4, score = 200
            //   7460                 | inc                 ebp
            //   8b4028               | test                esi, esi
            //   4533c0               | je                  0x24
            //   418bd5               | mov                 eax, dword ptr [ebp - 0x5c]

        $sequence_7 = { 745a 4863c2 410fb7bc40880b0000 85ff }
            // n = 4, score = 200
            //   745a                 | mov                 ecx, edi
            //   4863c2               | dec                 esp
            //   410fb7bc40880b0000     | mov    eax, esi
            //   85ff                 | dec                 eax

        $sequence_8 = { 8b7610 3bf7 75ea a1???????? 3bc7 }
            // n = 5, score = 200
            //   8b7610               | dec                 eax
            //   3bf7                 | lea                 ecx, [ebp - 0x28]
            //   75ea                 | je                  0x1c
            //   a1????????           |                     
            //   3bc7                 | cmp                 ecx, 1

        $sequence_9 = { 7464 482bef 48b90000000000000080 4885c1 }
            // n = 4, score = 200
            //   7464                 | mov                 eax, dword ptr [eax + 0x28]
            //   482bef               | inc                 ebp
            //   48b90000000000000080     | xor    eax, eax
            //   4885c1               | inc                 ecx

        $sequence_10 = { 56 57 8965f0 8365fc00 68d0070000 68e0930400 }
            // n = 6, score = 200
            //   56                   | dec                 eax
            //   57                   | sub                 ebp, edi
            //   8965f0               | dec                 eax
            //   8365fc00             | mov                 ecx, 0
            //   68d0070000           | add                 byte ptr [eax], al
            //   68e0930400           | add                 byte ptr [eax + 0x74c18548], al

        $sequence_11 = { 8b4df4 64890d00000000 c9 c20400 8b490c 85c9 7406 }
            // n = 7, score = 200
            //   8b4df4               | je                  0x17
            //   64890d00000000       | mov                 dword ptr [eax], 0x16
            //   c9                   | or                  eax, 0xffffffff
            //   c20400               | je                  0x1c
            //   8b490c               | cmp                 ecx, 1
            //   85c9                 | je                  0x1c
            //   7406                 | mov                 dword ptr [eax], 0x16

        $sequence_12 = { 7460 ffc9 0f84f8000000 ffc9 }
            // n = 4, score = 200
            //   7460                 | dec                 esp
            //   ffc9                 | mov                 eax, dword ptr [ecx]
            //   0f84f8000000         | inc                 ebp
            //   ffc9                 | cmp                 dword ptr [eax + 0x48], edi

        $sequence_13 = { 33db 895dfc c645fc01 385e08 7573 895dec 8d45ec }
            // n = 7, score = 200
            //   33db                 | dec                 eax
            //   895dfc               | sub                 ebp, edi
            //   c645fc01             | dec                 eax
            //   385e08               | mov                 ecx, 0
            //   7573                 | add                 byte ptr [eax], al
            //   895dec               | add                 byte ptr [eax + 0x74c18548], al
            //   8d45ec               | je                  0x66

        $sequence_14 = { 59 59 a3???????? 85c0 0f84c0fdffff }
            // n = 5, score = 200
            //   59                   | cmp                 ecx, 1
            //   59                   | je                  0x1a
            //   a3????????           |                     
            //   85c0                 | mov                 dword ptr [eax], 0x16
            //   0f84c0fdffff         | or                  eax, 0xffffffff

    condition:
        7 of them and filesize < 1676288
}