rule win_guidloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.guidloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.guidloader"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 498bf9 4c8970d4 498be8 448970dc 488bf1 c640c800 48895008 }
            // n = 7, score = 100
            //   498bf9               | dec                 eax
            //   4c8970d4             | lea                 edx, [ebp - 0x50]
            //   498be8               | dec                 eax
            //   448970dc             | mov                 ecx, edi
            //   488bf1               | inc                 ebp
            //   c640c800             | xor                 eax, eax
            //   48895008             | mov                 byte ptr [esp + 0x70], cl

        $sequence_1 = { 7306 8b548d94 eb03 418bd7 23d3 418bc1 }
            // n = 6, score = 100
            //   7306                 | ret                 
            //   8b548d94             | inc                 eax
            //   eb03                 | push                edi
            //   418bd7               | dec                 eax
            //   23d3                 | sub                 esp, 0x20
            //   418bc1               | dec                 eax

        $sequence_2 = { 750c 458bf7 44897d90 e9???????? 83f801 0f8419010000 4585f6 }
            // n = 7, score = 100
            //   750c                 | dec                 eax
            //   458bf7               | mov                 dword ptr [esp + 0x4f0], edi
            //   44897d90             | dec                 esp
            //   e9????????           |                     
            //   83f801               | mov                 dword ptr [esp + 0x4e8], ebp
            //   0f8419010000         | inc                 ebp
            //   4585f6               | xor                 ebp, ebp

        $sequence_3 = { 89442420 488d15a1160100 488d4dd0 e8???????? 0f57c0 0f11442478 0f57c9 }
            // n = 7, score = 100
            //   89442420             | lea                 edx, [ebp - 0x48]
            //   488d15a1160100       | dec                 eax
            //   488d4dd0             | mov                 ecx, esi
            //   e8????????           |                     
            //   0f57c0               | dec                 esp
            //   0f11442478           | mov                 edi, eax
            //   0f57c9               | movups              xmmword ptr [ebp - 0x58], xmm0

        $sequence_4 = { 4803f8 48897c2450 483bfb 0f856efbffff 4c8bb424e8070000 }
            // n = 5, score = 100
            //   4803f8               | mov                 ecx, dword ptr [ebp + eax*4 - 0x6c]
            //   48897c2450           | dec                 eax
            //   483bfb               | mov                 dword ptr [esp + 0x58], ecx
            //   0f856efbffff         | mov                 dword ptr [esp + 0x5c], edx
            //   4c8bb424e8070000     | test                ebx, ebx

        $sequence_5 = { 488d4c2420 e8???????? cc 4053 55 57 4156 }
            // n = 7, score = 100
            //   488d4c2420           | mov                 dword ptr [ebx + 0x28], eax
            //   e8????????           |                     
            //   cc                   | dec                 esp
            //   4053                 | lea                 esi, [ebx + 0x1a8]
            //   55                   | dec                 esp
            //   57                   | mov                 eax, dword ptr [edi + 0x28]
            //   4156                 | dec                 ebp

        $sequence_6 = { ffca e8???????? 837de000 742f e8???????? 486355e0 4803c2 }
            // n = 7, score = 100
            //   ffca                 | mov                 dword ptr [esi], 0
            //   e8????????           |                     
            //   837de000             | dec                 eax
            //   742f                 | cmp                 edi, ebp
            //   e8????????           |                     
            //   486355e0             | dec                 eax
            //   4803c2               | mov                 dword ptr [eax], ebx

        $sequence_7 = { 488d3d70fb0000 eb12 488b03 4885c0 7406 ff15???????? 4883c308 }
            // n = 7, score = 100
            //   488d3d70fb0000       | cmp                 eax, 0xb
            //   eb12                 | ja                  0x9d2
            //   488b03               | dec                 eax
            //   4885c0               | mov                 edi, dword ptr [ecx]
            //   7406                 | jmp                 0x78d
            //   ff15????????         |                     
            //   4883c308             | mov                 edx, dword ptr [ebx + 0x30]

        $sequence_8 = { 4c8d0d2503ffff 83f101 49c7c0ffffffff 03c9 8bc1 4803c2 4d8b94c190550100 }
            // n = 7, score = 100
            //   4c8d0d2503ffff       | test                eax, eax
            //   83f101               | jne                 0x198
            //   49c7c0ffffffff       | dec                 esp
            //   03c9                 | mov                 esi, esi
            //   8bc1                 | jmp                 0x1cc
            //   4803c2               | inc                 ecx
            //   4d8b94c190550100     | cmp                 byte ptr [eax], dh

        $sequence_9 = { 8982a0000000 0fb681a4000000 8882a4000000 83fb02 0f8c50010000 660f6f05???????? }
            // n = 6, score = 100
            //   8982a0000000         | jne                 0x135
            //   0fb681a4000000       | xor                 esi, esi
            //   8882a4000000         | test                eax, eax
            //   83fb02               | jle                 0x4e1
            //   0f8c50010000         | xor                 edi, edi
            //   660f6f05????????     |                     

    condition:
        7 of them and filesize < 49251328
}