rule win_global_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.global."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.global"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 760c bdd0feffff 8bc5 83c023 eb35 8d040a 3bc3 }
            // n = 7, score = 100
            //   760c                 | jbe                 0xe
            //   bdd0feffff           | mov                 ebp, 0xfffffed0
            //   8bc5                 | mov                 eax, ebp
            //   83c023               | add                 eax, 0x23
            //   eb35                 | jmp                 0x37
            //   8d040a               | lea                 eax, [edx + ecx]
            //   3bc3                 | cmp                 eax, ebx

        $sequence_1 = { a810 7413 57 53 }
            // n = 4, score = 100
            //   a810                 | test                al, 0x10
            //   7413                 | je                  0x15
            //   57                   | push                edi
            //   53                   | push                ebx

        $sequence_2 = { 33c4 89442420 57 8bf9 807f0900 0f85b1010000 6683bf8806000000 }
            // n = 7, score = 100
            //   33c4                 | xor                 eax, esp
            //   89442420             | mov                 dword ptr [esp + 0x20], eax
            //   57                   | push                edi
            //   8bf9                 | mov                 edi, ecx
            //   807f0900             | cmp                 byte ptr [edi + 9], 0
            //   0f85b1010000         | jne                 0x1b7
            //   6683bf8806000000     | cmp                 word ptr [edi + 0x688], 0

        $sequence_3 = { 8d4614 3918 0f8c90010000 0fb64618 8bce 50 ff75f7 }
            // n = 7, score = 100
            //   8d4614               | lea                 eax, [esi + 0x14]
            //   3918                 | cmp                 dword ptr [eax], ebx
            //   0f8c90010000         | jl                  0x196
            //   0fb64618             | movzx               eax, byte ptr [esi + 0x18]
            //   8bce                 | mov                 ecx, esi
            //   50                   | push                eax
            //   ff75f7               | push                dword ptr [ebp - 9]

        $sequence_4 = { 89442430 8b442444 c1e807 0bd0 8b442444 c1e802 0bc8 }
            // n = 7, score = 100
            //   89442430             | mov                 dword ptr [esp + 0x30], eax
            //   8b442444             | mov                 eax, dword ptr [esp + 0x44]
            //   c1e807               | shr                 eax, 7
            //   0bd0                 | or                  edx, eax
            //   8b442444             | mov                 eax, dword ptr [esp + 0x44]
            //   c1e802               | shr                 eax, 2
            //   0bc8                 | or                  ecx, eax

        $sequence_5 = { 0f44d8 0fb7462e 50 ff7604 897e30 ff36 e8???????? }
            // n = 7, score = 100
            //   0f44d8               | cmove               ebx, eax
            //   0fb7462e             | movzx               eax, word ptr [esi + 0x2e]
            //   50                   | push                eax
            //   ff7604               | push                dword ptr [esi + 4]
            //   897e30               | mov                 dword ptr [esi + 0x30], edi
            //   ff36                 | push                dword ptr [esi]
            //   e8????????           |                     

        $sequence_6 = { 8bcb 2944241c 8bc3 c1f819 c1f91f 23c8 8bc1 }
            // n = 7, score = 100
            //   8bcb                 | mov                 ecx, ebx
            //   2944241c             | sub                 dword ptr [esp + 0x1c], eax
            //   8bc3                 | mov                 eax, ebx
            //   c1f819               | sar                 eax, 0x19
            //   c1f91f               | sar                 ecx, 0x1f
            //   23c8                 | and                 ecx, eax
            //   8bc1                 | mov                 eax, ecx

        $sequence_7 = { 668945fc d96dfc 9b d97dfc 0fb74dfc be000c0000 83e101 }
            // n = 7, score = 100
            //   668945fc             | mov                 word ptr [ebp - 4], ax
            //   d96dfc               | fldcw               word ptr [ebp - 4]
            //   9b                   | wait                
            //   d97dfc               | fnstcw              word ptr [ebp - 4]
            //   0fb74dfc             | movzx               ecx, word ptr [ebp - 4]
            //   be000c0000           | mov                 esi, 0xc00
            //   83e101               | and                 ecx, 1

        $sequence_8 = { b9???????? e8???????? 68cc100000 8d842428030000 6a00 50 }
            // n = 6, score = 100
            //   b9????????           |                     
            //   e8????????           |                     
            //   68cc100000           | push                0x10cc
            //   8d842428030000       | lea                 eax, [esp + 0x328]
            //   6a00                 | push                0
            //   50                   | push                eax

        $sequence_9 = { 6a5c 89442428 8d842494000000 6a00 50 897c2434 895c242c }
            // n = 7, score = 100
            //   6a5c                 | push                0x5c
            //   89442428             | mov                 dword ptr [esp + 0x28], eax
            //   8d842494000000       | lea                 eax, [esp + 0x94]
            //   6a00                 | push                0
            //   50                   | push                eax
            //   897c2434             | mov                 dword ptr [esp + 0x34], edi
            //   895c242c             | mov                 dword ptr [esp + 0x2c], ebx

    condition:
        7 of them and filesize < 475136
}