rule win_hackbrowserdata_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.hackbrowserdata."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hackbrowserdata"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb2f 488b842478010000 4c89c1 bf01000000 488d358dda9e00 e8???????? 488b942490010000 }
            // n = 7, score = 100
            //   eb2f                 | nop                 
            //   488b842478010000     | test                eax, eax
            //   4c89c1               | jne                 0x20e
            //   bf01000000           | mov                 dword ptr [esp + 0x28], eax
            //   488d358dda9e00       | dec                 eax
            //   e8????????           |                     
            //   488b942490010000     | mov                 edx, dword ptr [esp + 0x30]

        $sequence_1 = { eb9f 4889f0 4c89c1 e8???????? 0f1f00 e8???????? 4889d9 }
            // n = 7, score = 100
            //   eb9f                 | cmp                 ecx, edx
            //   4889f0               | mov                 eax, 2
            //   4c89c1               | movzx               ecx, ax
            //   e8????????           |                     
            //   0f1f00               | dec                 eax
            //   e8????????           |                     
            //   4889d9               | mov                 eax, ecx

        $sequence_2 = { eb51 488b9c2490010000 488b842488050000 4c89e2 4d89fc 4589cf 4488542447 }
            // n = 7, score = 100
            //   eb51                 | nop                 
            //   488b9c2490010000     | jmp                 0x7de
            //   488b842488050000     | dec                 eax
            //   4c89e2               | mov                 dword ptr [esp + 8], eax
            //   4d89fc               | dec                 eax
            //   4589cf               | mov                 dword ptr [esp + 0x10], ebx
            //   4488542447           | dec                 eax

        $sequence_3 = { ff02 488b942440010000 418d5f01 8b12 4c8bbc24d8020000 4d85ff 0f854b020000 }
            // n = 7, score = 100
            //   ff02                 | mov                 eax, 0xffffff80
            //   488b942440010000     | call                ecx
            //   418d5f01             | mov                 eax, 0x39
            //   8b12                 | nop                 
            //   4c8bbc24d8020000     | call                ecx
            //   4d85ff               | dec                 eax
            //   0f854b020000         | mov                 ecx, dword ptr [eax]

        $sequence_4 = { ffd1 488b4c2438 48895928 833d????????00 7410 e8???????? 498903 }
            // n = 7, score = 100
            //   ffd1                 | mov                 edx, eax
            //   488b4c2438           | mov                 eax, 0xffffff82
            //   48895928             | call                ecx
            //   833d????????00       |                     
            //   7410                 | dec                 eax
            //   e8????????           |                     
            //   498903               | mov                 ecx, dword ptr [eax]

        $sequence_5 = { f20f1100 eb08 488b8c24a0000000 4889c8 488b5c2460 8b7c2440 4c8b442448 }
            // n = 7, score = 100
            //   f20f1100             | mov                 ecx, dword ptr [eax]
            //   eb08                 | dec                 eax
            //   488b8c24a0000000     | mov                 edx, eax
            //   4889c8               | mov                 eax, 0xfffffff1
            //   488b5c2460           | call                ecx
            //   8b7c2440             | mov                 eax, 0x10
            //   4c8b442448           | nop                 

        $sequence_6 = { f20f11442468 4c89842490000000 498b02 4889cb e8???????? 488b4c2440 488b942430010000 }
            // n = 7, score = 100
            //   f20f11442468         | dec                 eax
            //   4c89842490000000     | mov                 edx, eax
            //   498b02               | mov                 eax, 0x37
            //   4889cb               | nop                 
            //   e8????????           |                     
            //   488b4c2440           | call                ecx
            //   488b942430010000     | mov                 eax, 0x12

        $sequence_7 = { eb80 895628 4889da 837a2802 7f64 488b5220 488db3b8020000 }
            // n = 7, score = 100
            //   eb80                 | inc                 esp
            //   895628               | lea                 edx, [edx + 1]
            //   4889da               | dec                 ebp
            //   837a2802             | add                 ecx, dword ptr [eax + 0x18]
            //   7f64                 | mov                 eax, 1
            //   488b5220             | dec                 esp
            //   488db3b8020000       | mov                 eax, eax

        $sequence_8 = { ffd6 488b942468010000 48891a 833d????????00 7410 e8???????? 49890b }
            // n = 7, score = 100
            //   ffd6                 | nop                 
            //   488b942468010000     | call                ecx
            //   48891a               | dec                 eax
            //   833d????????00       |                     
            //   7410                 | mov                 ecx, dword ptr [eax]
            //   e8????????           |                     
            //   49890b               | dec                 eax

        $sequence_9 = { e8???????? 498903 4c8b44daf8 4d894308 ebad 48895c2440 4889542468 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   498903               | movzx               edx, byte ptr [esp + 0x45]
            //   4c8b44daf8           | mov                 byte ptr [esp + 0x8b], dl
            //   4d894308             | movzx               edx, byte ptr [esp + 0x38]
            //   ebad                 | mov                 byte ptr [esp + 0x8c], dl
            //   48895c2440           | mov                 byte ptr [esp + 0x89], dl
            //   4889542468           | movzx               edx, byte ptr [esp + 0x4c]

    condition:
        7 of them and filesize < 42451968
}