rule win_flawedammyy_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.flawedammyy."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3b58fc 0f8ebc000000 85c0 7514 }
            // n = 4, score = 200
            //   3b58fc               | cmp                 ebx, dword ptr [eax - 4]
            //   0f8ebc000000         | jle                 0xc2
            //   85c0                 | test                eax, eax
            //   7514                 | jne                 0x16

        $sequence_1 = { 0000 0404 0404 0404 0401 0404 }
            // n = 6, score = 200
            //   0000                 | add                 byte ptr [eax], al
            //   0404                 | add                 al, 4
            //   0404                 | add                 al, 4
            //   0404                 | add                 al, 4
            //   0401                 | add                 al, 1
            //   0404                 | add                 al, 4

        $sequence_2 = { eb6c 682680acc8 6a01 e8???????? 83c408 68???????? eb56 }
            // n = 7, score = 200
            //   eb6c                 | jmp                 0x6e
            //   682680acc8           | push                0xc8ac8026
            //   6a01                 | push                1
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   68????????           |                     
            //   eb56                 | jmp                 0x58

        $sequence_3 = { ff515c 8d4df0 8bf0 e8???????? 8b4de8 51 8b11 }
            // n = 7, score = 200
            //   ff515c               | call                dword ptr [ecx + 0x5c]
            //   8d4df0               | lea                 ecx, [ebp - 0x10]
            //   8bf0                 | mov                 esi, eax
            //   e8????????           |                     
            //   8b4de8               | mov                 ecx, dword ptr [ebp - 0x18]
            //   51                   | push                ecx
            //   8b11                 | mov                 edx, dword ptr [ecx]

        $sequence_4 = { 3b7d08 7caf 5f 5e 5b }
            // n = 5, score = 200
            //   3b7d08               | cmp                 edi, dword ptr [ebp + 8]
            //   7caf                 | jl                  0xffffffb1
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

        $sequence_5 = { 3b5634 7ce8 eb76 8b4604 8b4d08 }
            // n = 5, score = 200
            //   3b5634               | cmp                 edx, dword ptr [esi + 0x34]
            //   7ce8                 | jl                  0xffffffea
            //   eb76                 | jmp                 0x78
            //   8b4604               | mov                 eax, dword ptr [esi + 4]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]

        $sequence_6 = { 3b5808 7e0f 8bce e8???????? }
            // n = 4, score = 200
            //   3b5808               | cmp                 ebx, dword ptr [eax + 8]
            //   7e0f                 | jle                 0x11
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     

        $sequence_7 = { 3b5634 7d22 8b4df8 8d4206 }
            // n = 4, score = 200
            //   3b5634               | cmp                 edx, dword ptr [esi + 0x34]
            //   7d22                 | jge                 0x24
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8d4206               | lea                 eax, [edx + 6]

        $sequence_8 = { 8d85bcfcffff 68???????? 50 ffd3 68dff0f081 6a01 e8???????? }
            // n = 7, score = 200
            //   8d85bcfcffff         | lea                 eax, [ebp - 0x344]
            //   68????????           |                     
            //   50                   | push                eax
            //   ffd3                 | call                ebx
            //   68dff0f081           | push                0x81f0f0df
            //   6a01                 | push                1
            //   e8????????           |                     

        $sequence_9 = { 8d85bcfdffff 50 68???????? e8???????? 83c408 }
            // n = 5, score = 200
            //   8d85bcfdffff         | lea                 eax, [ebp - 0x244]
            //   50                   | push                eax
            //   68????????           |                     
            //   e8????????           |                     
            //   83c408               | add                 esp, 8

        $sequence_10 = { 8365fc00 8b45e4 8b048588ae4100 f644180401 7418 ff7514 ff7510 }
            // n = 7, score = 200
            //   8365fc00             | and                 dword ptr [ebp - 4], 0
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   8b048588ae4100       | mov                 eax, dword ptr [eax*4 + 0x41ae88]
            //   f644180401           | test                byte ptr [eax + ebx + 4], 1
            //   7418                 | je                  0x1a
            //   ff7514               | push                dword ptr [ebp + 0x14]
            //   ff7510               | push                dword ptr [ebp + 0x10]

        $sequence_11 = { 72c3 5e 8aca 5f 88b800010000 888801010000 }
            // n = 6, score = 200
            //   72c3                 | jb                  0xffffffc5
            //   5e                   | pop                 esi
            //   8aca                 | mov                 cl, dl
            //   5f                   | pop                 edi
            //   88b800010000         | mov                 byte ptr [eax + 0x100], bh
            //   888801010000         | mov                 byte ptr [eax + 0x101], cl

        $sequence_12 = { 3b573c 7ca8 8b5d1c 8b87dc000000 }
            // n = 4, score = 200
            //   3b573c               | cmp                 edx, dword ptr [edi + 0x3c]
            //   7ca8                 | jl                  0xffffffaa
            //   8b5d1c               | mov                 ebx, dword ptr [ebp + 0x1c]
            //   8b87dc000000         | mov                 eax, dword ptr [edi + 0xdc]

        $sequence_13 = { 3b5910 0f82de000000 8d4508 50 }
            // n = 4, score = 200
            //   3b5910               | cmp                 ebx, dword ptr [ecx + 0x10]
            //   0f82de000000         | jb                  0xe4
            //   8d4508               | lea                 eax, [ebp + 8]
            //   50                   | push                eax

        $sequence_14 = { e8???????? 83c408 68???????? 56 ffd0 68???????? }
            // n = 6, score = 200
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   68????????           |                     
            //   56                   | push                esi
            //   ffd0                 | call                eax
            //   68????????           |                     

        $sequence_15 = { 0fbe80a8384100 83e00f eb02 33c0 8bbdbcfdffff 0fbebcc7c8384100 }
            // n = 6, score = 200
            //   0fbe80a8384100       | movsx               eax, byte ptr [eax + 0x4138a8]
            //   83e00f               | and                 eax, 0xf
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax
            //   8bbdbcfdffff         | mov                 edi, dword ptr [ebp - 0x244]
            //   0fbebcc7c8384100     | movsx               edi, byte ptr [edi + eax*8 + 0x4138c8]

        $sequence_16 = { eb08 6a64 ff15???????? 53 ff75a8 ff15???????? }
            // n = 6, score = 100
            //   eb08                 | jmp                 0xa
            //   6a64                 | push                0x64
            //   ff15????????         |                     
            //   53                   | push                ebx
            //   ff75a8               | push                dword ptr [ebp - 0x58]
            //   ff15????????         |                     

        $sequence_17 = { 50 881f ff15???????? 53 8d85ccfdffff 56 50 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   881f                 | mov                 byte ptr [edi], bl
            //   ff15????????         |                     
            //   53                   | push                ebx
            //   8d85ccfdffff         | lea                 eax, [ebp - 0x234]
            //   56                   | push                esi
            //   50                   | push                eax

        $sequence_18 = { 8b3d???????? ffd7 ff75a8 ffd7 ff75dc }
            // n = 5, score = 100
            //   8b3d????????         |                     
            //   ffd7                 | call                edi
            //   ff75a8               | push                dword ptr [ebp - 0x58]
            //   ffd7                 | call                edi
            //   ff75dc               | push                dword ptr [ebp - 0x24]

        $sequence_19 = { 7431 6aff ff75e8 ff15???????? 8d45f8 50 ff75e8 }
            // n = 7, score = 100
            //   7431                 | je                  0x33
            //   6aff                 | push                -1
            //   ff75e8               | push                dword ptr [ebp - 0x18]
            //   ff15????????         |                     
            //   8d45f8               | lea                 eax, [ebp - 8]
            //   50                   | push                eax
            //   ff75e8               | push                dword ptr [ebp - 0x18]

        $sequence_20 = { 8b7df4 8b0c855c303400 c1e705 33d2 03fe 42 837dfcff }
            // n = 7, score = 100
            //   8b7df4               | mov                 edi, dword ptr [ebp - 0xc]
            //   8b0c855c303400       | mov                 ecx, dword ptr [eax*4 + 0x34305c]
            //   c1e705               | shl                 edi, 5
            //   33d2                 | xor                 edx, edx
            //   03fe                 | add                 edi, esi
            //   42                   | inc                 edx
            //   837dfcff             | cmp                 dword ptr [ebp - 4], -1

        $sequence_21 = { 8b46f8 8b04855c303400 c1e002 50 6a40 }
            // n = 5, score = 100
            //   8b46f8               | mov                 eax, dword ptr [esi - 8]
            //   8b04855c303400       | mov                 eax, dword ptr [eax*4 + 0x34305c]
            //   c1e002               | shl                 eax, 2
            //   50                   | push                eax
            //   6a40                 | push                0x40

        $sequence_22 = { 834de4ff 49 c745e8ff000000 8b3c857c303400 c745ecffff0000 }
            // n = 5, score = 100
            //   834de4ff             | or                  dword ptr [ebp - 0x1c], 0xffffffff
            //   49                   | dec                 ecx
            //   c745e8ff000000       | mov                 dword ptr [ebp - 0x18], 0xff
            //   8b3c857c303400       | mov                 edi, dword ptr [eax*4 + 0x34307c]
            //   c745ecffff0000       | mov                 dword ptr [ebp - 0x14], 0xffff

        $sequence_23 = { ff15???????? a1???????? 56 85c0 742f 8b30 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   a1????????           |                     
            //   56                   | push                esi
            //   85c0                 | test                eax, eax
            //   742f                 | je                  0x31
            //   8b30                 | mov                 esi, dword ptr [eax]

        $sequence_24 = { 8bfe 381e 0f848e000000 8a06 3c0d }
            // n = 5, score = 100
            //   8bfe                 | mov                 edi, esi
            //   381e                 | cmp                 byte ptr [esi], bl
            //   0f848e000000         | je                  0x94
            //   8a06                 | mov                 al, byte ptr [esi]
            //   3c0d                 | cmp                 al, 0xd

        $sequence_25 = { e8???????? 8bf8 59 3bfb 59 75a4 8b75fc }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8bf8                 | mov                 edi, eax
            //   59                   | pop                 ecx
            //   3bfb                 | cmp                 edi, ebx
            //   59                   | pop                 ecx
            //   75a4                 | jne                 0xffffffa6
            //   8b75fc               | mov                 esi, dword ptr [ebp - 4]

        $sequence_26 = { ff15???????? e9???????? 57 8945e4 }
            // n = 4, score = 100
            //   ff15????????         |                     
            //   e9????????           |                     
            //   57                   | push                edi
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax

        $sequence_27 = { 8b14957c303400 49 0fafd1 0155fc }
            // n = 4, score = 100
            //   8b14957c303400       | mov                 edx, dword ptr [edx*4 + 0x34307c]
            //   49                   | dec                 ecx
            //   0fafd1               | imul                edx, ecx
            //   0155fc               | add                 dword ptr [ebp - 4], edx

        $sequence_28 = { 83f855 0f872affffff 0fb6805a213400 ff2485f6203400 8b8614080000 3b45f4 }
            // n = 6, score = 100
            //   83f855               | cmp                 eax, 0x55
            //   0f872affffff         | ja                  0xffffff30
            //   0fb6805a213400       | movzx               eax, byte ptr [eax + 0x34215a]
            //   ff2485f6203400       | jmp                 dword ptr [eax*4 + 0x3420f6]
            //   8b8614080000         | mov                 eax, dword ptr [esi + 0x814]
            //   3b45f4               | cmp                 eax, dword ptr [ebp - 0xc]

        $sequence_29 = { 751e 837efcff 7518 8b46f8 8b04855c303400 }
            // n = 5, score = 100
            //   751e                 | jne                 0x20
            //   837efcff             | cmp                 dword ptr [esi - 4], -1
            //   7518                 | jne                 0x1a
            //   8b46f8               | mov                 eax, dword ptr [esi - 8]
            //   8b04855c303400       | mov                 eax, dword ptr [eax*4 + 0x34305c]

        $sequence_30 = { c705????????4c403400 ff7508 ff15???????? 5a }
            // n = 4, score = 100
            //   c705????????4c403400     |     
            //   ff7508               | push                dword ptr [ebp + 8]
            //   ff15????????         |                     
            //   5a                   | pop                 edx

        $sequence_31 = { 83661c00 83f807 0f87c9000000 ff248580233400 832700 e9???????? }
            // n = 6, score = 100
            //   83661c00             | and                 dword ptr [esi + 0x1c], 0
            //   83f807               | cmp                 eax, 7
            //   0f87c9000000         | ja                  0xcf
            //   ff248580233400       | jmp                 dword ptr [eax*4 + 0x342380]
            //   832700               | and                 dword ptr [edi], 0
            //   e9????????           |                     

    condition:
        7 of them and filesize < 1350656
}