rule win_graphdown_w0 {
    meta:
        author = "Insikt Group, Recorded Future"
        date = "2023-05-11"
        description = "Detects unpacked GraphicalProton samples"
        version = "1.0"
        hash = "38f8b8036ed2a0b5abb8fbf264ee6fd2b82dcd917f60d9f1d8f18d07c26b1534"
        hash = "60d96d8d3a09f822ded0a3c84194a5d88ed62a979cbb6378545b45b04353bb37"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdown"
        malpedia_rule_date = "20230728"
        malpedia_hash = ""
        malpedia_version = "20230728"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
        
        
    strings:
        $chaskey = { 4? 8b 44 ?4 08 8b 48 04 4? 8b 44 ?4 08 03 08 89 08 4? 8b 44 ?4 08 8b 48 04 c1 e9 1b 4? 8b 44 ?4 08
        8b 50 04 c1 e2 05 09 d1 4? 8b 44 ?4 08 33 08 4? 8b 44 ?4 08 89 48 04 4? 8b 44 ?4 08 8b 48 0c 4? 8b 44 ?4 08 03 48 08
        89 48 08 4? 8b 44 ?4 08 8b 48 0c c1 e9 18 4? 8b 44 ?4 08 8b 50 0c c1 e2 08 09 d1 4? 8b 44 ?4 08 33 48 08 4? 8b 44 ?4
        08 89 48 0c 4? 8b 44 ?4 08 8b 48 04 4? 8b 44 ?4 08 03 48 08 89 48 08 4? 8b 44 ?4 08 8b 08 c1 e9 10 4? 8b 44 ?4 08 8b
        10 c1 e2 10 09 d1 4? 8b 44 ?4 08 03 48 0c 4? 8b 44 ?4 08 89 08 4? 8b 44 ?4 08 8b 48 0c c1 e9 13 4? 8b 44 ?4 08 8b 50
        0c c1 e2 0d 09 d1 4? 8b 44 ?4 08 33 08 4? 8b 44 ?4 08 89 48 0c 4? 8b 44 ?4 08 8b 48 04 c1 e9 19 4? 8b 44 ?4 08 8b 50
        04 c1 e2 07 09 d1 4? 8b 44 ?4 08 33 48 08 4? 8b 44 ?4 08 89 48 04 4? 8b 44 ?4 08 8b 48 08 c1 e9 10 4? 8b 44 ?4 08 8b
        50 08 c1 e2 10 09 d1 4? 8b 44 ?4 08 89 48 08 }
        
        $decrypt = { 8b 44 ?? ?? 89 c1 0f b6 44 0c 50 4? 8b 4c ?? ?? 8b 54 ?? ?? 4? 89 d0 4? 0f b6 14 01 31 c2 4? 88 14
        01 8b 44 ?? ?? 83 c0 01 89 44 ?? ?? e9 ?? ?? ?? ?? 8b 44 ?? ?? 8b 4c ?? ?? 29 c1 89 4c ?? ?? 8b 44 ?? ?? 4? 8b 54 ??
        ?? 89 c0 4? 89 c0 4? 01 c2 4? 89 54 ?? ?? }
        
        $bmp_header = { 66 c7 00 42 4d c7 40 02 00 00 00 00 66 c7 40 06 00 00 66 c7 40 08 00 00 c7 40 0a 00 00 00 00 59 c3 }
        
        $parse_bmp = { 89 02 4? 8b 4? ?? ba 03 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 04 4? 8b 4? ?? ba
        07 00 00 00 e8 ?? ?? ?? ?? 66 4? 8b 08 4? 8b 4? ?? 66 4? 89 48 08 4? 8b 4? ?? ba 09 00 00 00 e8 ?? ?? ?? ?? 66 4? 8b
        08 4? 8b 4? ?? 66 4? 89 48 0a 4? 8b 4? ?? ba 0b 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 0c 4? 8b 4? ??
        ba 0f 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 10 4? 8b 4? ?? ba 13 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4?
        8b 4? ?? 4? 89 40 14 4? 8b 4? ?? ba 17 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 18 4? 8b 4? ?? ba 1b 00
        00 00 e8 ?? ?? ?? ?? 66 4? 8b 08 4? 8b 4? ?? 66 4? 89 48 1c 4? 8b 4? ?? ba 1d 00 00 00 e8 ?? ?? ?? ?? 66 4? 8b 08 4?
        8b 4? ?? 66 4? 89 48 1e 4? 8b 4? ?? ba 1f 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 20 4? 8b 4? ?? ba 23
        00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 24 4? 8b 4? ?? ba 27 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4?
        ?? 4? 89 40 28 4? 8b 4? ?? ba 2b 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 2c 4? 8b 4? ?? ba 2f 00 00 00
        e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89 40 30 4? 8b 4? ?? ba 33 00 00 00 e8 ?? ?? ?? ?? 4? 8b 00 4? 8b 4? ?? 4? 89
        40 34 4? 8b 40 14 4? 89 4? ?? 4? 8b 40 18 4? 89 4? ?? 4? 8b 4? ?? 4? 0f af 4? ?? 4? 6b c0 03 4? 89 4? ?? 4? 8b 4? ??
        4? c1 e8 03 4? 83 e8 36 4? 89 40 38 }
    condition:
        uint16(0) == 0x5a4d
        and filesize > 1MB
        and all of them
}

rule win_graphdrop_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.graphdrop."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdrop"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 52 4156 415e 5a }
            // n = 4, score = 300
            //   52                   | mov                 dword ptr [esp + 0x50], edx
            //   4156                 | inc                 esp
            //   415e                 | mov                 edx, edx
            //   5a                   | inc                 esp

        $sequence_1 = { 4155 49c7c501000000 4150 4152 415a }
            // n = 5, score = 300
            //   4155                 | movsx               edx, byte ptr [eax + ecx]
            //   49c7c501000000       | cmp                 edx, 0
            //   4150                 | inc                 ecx
            //   4152                 | setne               al
            //   415a                 | mov                 ecx, edx

        $sequence_2 = { 53 0f77 5b 90 }
            // n = 4, score = 300
            //   53                   | jbe                 0x1b69
            //   0f77                 | dec                 eax
            //   5b                   | mov                 ecx, dword ptr [ebp]
            //   90                   | mov                 edi, 1

        $sequence_3 = { 90 415f 90 415d }
            // n = 4, score = 300
            //   90                   | dec                 eax
            //   415f                 | lea                 ecx, [esp + 0x20]
            //   90                   | dec                 eax
            //   415d                 | lea                 edx, [eax + 0x30]

        $sequence_4 = { 49c7c501000000 4150 4152 415a 4158 }
            // n = 5, score = 300
            //   49c7c501000000       | movzx               eax, word ptr [esp + 0x20]
            //   4150                 | dec                 eax
            //   4152                 | lea                 edx, [esp + 0x30]
            //   415a                 | dec                 eax
            //   4158                 | mov                 edi, dword ptr [esp + 0x68]

        $sequence_5 = { 0f77 4157 90 415f }
            // n = 4, score = 300
            //   0f77                 | psrlq               mm5, 0x15
            //   4157                 | inc                 ecx
            //   90                   | push                eax
            //   415f                 | inc                 ecx

        $sequence_6 = { 415b 50 0f77 4155 }
            // n = 4, score = 300
            //   415b                 | psraw               mm3, 0x4c
            //   50                   | push                edx
            //   0f77                 | inc                 ecx
            //   4155                 | push                edx

        $sequence_7 = { 58 e9???????? 53 48c7c303000000 }
            // n = 4, score = 300
            //   58                   | mov                 eax, dword ptr [ebp - 0x30]
            //   e9????????           |                     
            //   53                   | dec                 eax
            //   48c7c303000000       | mov                 edx, dword ptr [ebp - 0x28]

        $sequence_8 = { 4155 49c7c501000000 4150 4152 415a 4158 }
            // n = 6, score = 300
            //   4155                 | mov                 eax, 0x3c
            //   49c7c501000000       | dec                 eax
            //   4150                 | lea                 ecx, [ebp + 0x78]
            //   4152                 | dec                 eax
            //   415a                 | lea                 ecx, [ebp + 0x38]
            //   4158                 | dec                 eax

        $sequence_9 = { 50 90 53 0f77 }
            // n = 4, score = 300
            //   50                   | mov                 edx, dword ptr [esp + 0x40]
            //   90                   | dec                 eax
            //   53                   | mov                 ecx, dword ptr [esp + 0x50]
            //   0f77                 | inc                 esp

    condition:
        7 of them and filesize < 4186112
}