rule win_gameover_dga_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_dga"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff3498 ff520c 43 3b5e08 72ed 5b 57 }
            // n = 7, score = 700
            //   ff3498               | push                dword ptr [eax + ebx*4]
            //   ff520c               | call                dword ptr [edx + 0xc]
            //   43                   | inc                 ebx
            //   3b5e08               | cmp                 ebx, dword ptr [esi + 8]
            //   72ed                 | jb                  0xffffffef
            //   5b                   | pop                 ebx
            //   57                   | push                edi

        $sequence_1 = { 8b401c 89461c eb5e 833f00 7458 8b6f08 8d4c2414 }
            // n = 7, score = 700
            //   8b401c               | mov                 eax, dword ptr [eax + 0x1c]
            //   89461c               | mov                 dword ptr [esi + 0x1c], eax
            //   eb5e                 | jmp                 0x60
            //   833f00               | cmp                 dword ptr [edi], 0
            //   7458                 | je                  0x5a
            //   8b6f08               | mov                 ebp, dword ptr [edi + 8]
            //   8d4c2414             | lea                 ecx, [esp + 0x14]

        $sequence_2 = { e8???????? 8bc6 5e 5d 5b 8be5 5d }
            // n = 7, score = 700
            //   e8????????           |                     
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp

        $sequence_3 = { 7421 83650800 0fb6c1 8a44050c 30043a fec1 80f904 }
            // n = 7, score = 700
            //   7421                 | je                  0x23
            //   83650800             | and                 dword ptr [ebp + 8], 0
            //   0fb6c1               | movzx               eax, cl
            //   8a44050c             | mov                 al, byte ptr [ebp + eax + 0xc]
            //   30043a               | xor                 byte ptr [edx + edi], al
            //   fec1                 | inc                 cl
            //   80f904               | cmp                 cl, 4

        $sequence_4 = { 8be5 5d c21000 81ecd0020000 8d8424c8000000 53 55 }
            // n = 7, score = 700
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c21000               | ret                 0x10
            //   81ecd0020000         | sub                 esp, 0x2d0
            //   8d8424c8000000       | lea                 eax, [esp + 0xc8]
            //   53                   | push                ebx
            //   55                   | push                ebp

        $sequence_5 = { 8b476c 33c9 2bc3 41 3bc1 0f8c5d130000 }
            // n = 6, score = 700
            //   8b476c               | mov                 eax, dword ptr [edi + 0x6c]
            //   33c9                 | xor                 ecx, ecx
            //   2bc3                 | sub                 eax, ebx
            //   41                   | inc                 ecx
            //   3bc1                 | cmp                 eax, ecx
            //   0f8c5d130000         | jl                  0x1363

        $sequence_6 = { 8b442430 3903 7709 2b03 3d803a0900 76a7 3bee }
            // n = 7, score = 700
            //   8b442430             | mov                 eax, dword ptr [esp + 0x30]
            //   3903                 | cmp                 dword ptr [ebx], eax
            //   7709                 | ja                  0xb
            //   2b03                 | sub                 eax, dword ptr [ebx]
            //   3d803a0900           | cmp                 eax, 0x93a80
            //   76a7                 | jbe                 0xffffffa9
            //   3bee                 | cmp                 ebp, esi

        $sequence_7 = { 8d7714 83670800 24fe 0c02 88470c }
            // n = 5, score = 700
            //   8d7714               | lea                 esi, [edi + 0x14]
            //   83670800             | and                 dword ptr [edi + 8], 0
            //   24fe                 | and                 al, 0xfe
            //   0c02                 | or                  al, 2
            //   88470c               | mov                 byte ptr [edi + 0xc], al

        $sequence_8 = { 0f94c3 33d2 43 f7f3 5b c20400 83ec14 }
            // n = 7, score = 700
            //   0f94c3               | sete                bl
            //   33d2                 | xor                 edx, edx
            //   43                   | inc                 ebx
            //   f7f3                 | div                 ebx
            //   5b                   | pop                 ebx
            //   c20400               | ret                 4
            //   83ec14               | sub                 esp, 0x14

        $sequence_9 = { e8???????? 33c0 5f 5e 5b c20c00 8bcb }
            // n = 7, score = 700
            //   e8????????           |                     
            //   33c0                 | xor                 eax, eax
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c20c00               | ret                 0xc
            //   8bcb                 | mov                 ecx, ebx

    condition:
        7 of them and filesize < 540672
}