rule win_jaku_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.jaku."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 50 ff7510 e8???????? 83c40c c6450f01 eb04 }
            // n = 7, score = 1500
            //   56                   | push                esi
            //   50                   | push                eax
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   c6450f01             | mov                 byte ptr [ebp + 0xf], 1
            //   eb04                 | jmp                 6

        $sequence_1 = { f6461102 7417 ff75f0 ff75fc ff7618 e8???????? }
            // n = 6, score = 1500
            //   f6461102             | test                byte ptr [esi + 0x11], 2
            //   7417                 | je                  0x19
            //   ff75f0               | push                dword ptr [ebp - 0x10]
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   ff7618               | push                dword ptr [esi + 0x18]
            //   e8????????           |                     

        $sequence_2 = { 8975ec ff7508 e8???????? 59 3bc6 59 7e61 }
            // n = 7, score = 1500
            //   8975ec               | mov                 dword ptr [ebp - 0x14], esi
            //   ff7508               | push                dword ptr [ebp + 8]
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   3bc6                 | cmp                 eax, esi
            //   59                   | pop                 ecx
            //   7e61                 | jle                 0x63

        $sequence_3 = { 7404 33c9 eb05 b900010000 8b5604 f7da }
            // n = 6, score = 1500
            //   7404                 | je                  6
            //   33c9                 | xor                 ecx, ecx
            //   eb05                 | jmp                 7
            //   b900010000           | mov                 ecx, 0x100
            //   8b5604               | mov                 edx, dword ptr [esi + 4]
            //   f7da                 | neg                 edx

        $sequence_4 = { 83c004 c1eb04 817e601e010000 89465c 895df4 }
            // n = 5, score = 1500
            //   83c004               | add                 eax, 4
            //   c1eb04               | shr                 ebx, 4
            //   817e601e010000       | cmp                 dword ptr [esi + 0x60], 0x11e
            //   89465c               | mov                 dword ptr [esi + 0x5c], eax
            //   895df4               | mov                 dword ptr [ebp - 0xc], ebx

        $sequence_5 = { ff74240c ff15???????? b001 5f 5e }
            // n = 5, score = 1500
            //   ff74240c             | push                dword ptr [esp + 0xc]
            //   ff15????????         |                     
            //   b001                 | mov                 al, 1
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_6 = { 8b7d08 33f6 3bd6 7e10 3bfe }
            // n = 5, score = 1500
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]
            //   33f6                 | xor                 esi, esi
            //   3bd6                 | cmp                 edx, esi
            //   7e10                 | jle                 0x12
            //   3bfe                 | cmp                 edi, esi

        $sequence_7 = { 8b4e74 775a 83f903 7255 48 894660 }
            // n = 6, score = 1500
            //   8b4e74               | mov                 ecx, dword ptr [esi + 0x74]
            //   775a                 | ja                  0x5c
            //   83f903               | cmp                 ecx, 3
            //   7255                 | jb                  0x57
            //   48                   | dec                 eax
            //   894660               | mov                 dword ptr [esi + 0x60], eax

        $sequence_8 = { 68???????? ff15???????? c3 b8???????? e8???????? 83ec2c }
            // n = 6, score = 700
            //   68????????           |                     
            //   ff15????????         |                     
            //   c3                   | ret                 
            //   b8????????           |                     
            //   e8????????           |                     
            //   83ec2c               | sub                 esp, 0x2c

        $sequence_9 = { ff742408 e8???????? c20800 8bc1 }
            // n = 4, score = 500
            //   ff742408             | push                dword ptr [esp + 8]
            //   e8????????           |                     
            //   c20800               | ret                 8
            //   8bc1                 | mov                 eax, ecx

        $sequence_10 = { 50 e8???????? 59 8b4e2c }
            // n = 4, score = 400
            //   50                   | push                eax
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   8b4e2c               | mov                 ecx, dword ptr [esi + 0x2c]

        $sequence_11 = { 53 68000000a0 6a03 53 }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   68000000a0           | push                0xa0000000
            //   6a03                 | push                3
            //   53                   | push                ebx

        $sequence_12 = { 5e 5b c3 55 8bec 833d????????00 53 }
            // n = 7, score = 400
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c3                   | ret                 
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   833d????????00       |                     
            //   53                   | push                ebx

        $sequence_13 = { 56 e8???????? 59 8b4620 }
            // n = 4, score = 400
            //   56                   | push                esi
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   8b4620               | mov                 eax, dword ptr [esi + 0x20]

        $sequence_14 = { 55 56 57 6880020000 }
            // n = 4, score = 400
            //   55                   | push                ebp
            //   56                   | push                esi
            //   57                   | push                edi
            //   6880020000           | push                0x280

        $sequence_15 = { 7507 b800308000 eb02 33c0 }
            // n = 4, score = 400
            //   7507                 | jne                 9
            //   b800308000           | mov                 eax, 0x803000
            //   eb02                 | jmp                 4
            //   33c0                 | xor                 eax, eax

        $sequence_16 = { 8b400c 8b400c 8b00 8b00 8b4018 8945fc 8b45fc }
            // n = 7, score = 400
            //   8b400c               | mov                 eax, dword ptr [eax + 0xc]
            //   8b400c               | mov                 eax, dword ptr [eax + 0xc]
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   8b4018               | mov                 eax, dword ptr [eax + 0x18]
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_17 = { 64890d00000000 c9 c3 c3 56 8bf1 }
            // n = 6, score = 400
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   c9                   | leave               
            //   c3                   | ret                 
            //   c3                   | ret                 
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx

        $sequence_18 = { e8???????? 59 eb57 53 }
            // n = 4, score = 400
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   eb57                 | jmp                 0x59
            //   53                   | push                ebx

        $sequence_19 = { 75dd 57 e8???????? 59 }
            // n = 4, score = 400
            //   75dd                 | jne                 0xffffffdf
            //   57                   | push                edi
            //   e8????????           |                     
            //   59                   | pop                 ecx

        $sequence_20 = { 6a01 03c3 68???????? 50 e8???????? 83c40c 85c0 }
            // n = 7, score = 400
            //   6a01                 | push                1
            //   03c3                 | add                 eax, ebx
            //   68????????           |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   85c0                 | test                eax, eax

        $sequence_21 = { 7508 83c8ff e9???????? 8b839f830000 }
            // n = 4, score = 400
            //   7508                 | jne                 0xa
            //   83c8ff               | or                  eax, 0xffffffff
            //   e9????????           |                     
            //   8b839f830000         | mov                 eax, dword ptr [ebx + 0x839f]

        $sequence_22 = { 85f6 0f8416020000 8bcf 33c0 8bd1 8bfe }
            // n = 6, score = 300
            //   85f6                 | test                esi, esi
            //   0f8416020000         | je                  0x21c
            //   8bcf                 | mov                 ecx, edi
            //   33c0                 | xor                 eax, eax
            //   8bd1                 | mov                 edx, ecx
            //   8bfe                 | mov                 edi, esi

        $sequence_23 = { 85f6 0f8492000000 68???????? 68???????? }
            // n = 4, score = 300
            //   85f6                 | test                esi, esi
            //   0f8492000000         | je                  0x98
            //   68????????           |                     
            //   68????????           |                     

        $sequence_24 = { 3b4e08 7507 8bce e8???????? ff7604 }
            // n = 5, score = 200
            //   3b4e08               | cmp                 ecx, dword ptr [esi + 8]
            //   7507                 | jne                 9
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   ff7604               | push                dword ptr [esi + 4]

        $sequence_25 = { 85c0 74d2 39bb98000000 0f86fe000000 c745dc0f000000 897dd8 c645c800 }
            // n = 7, score = 200
            //   85c0                 | test                eax, eax
            //   74d2                 | je                  0xffffffd4
            //   39bb98000000         | cmp                 dword ptr [ebx + 0x98], edi
            //   0f86fe000000         | jbe                 0x104
            //   c745dc0f000000       | mov                 dword ptr [ebp - 0x24], 0xf
            //   897dd8               | mov                 dword ptr [ebp - 0x28], edi
            //   c645c800             | mov                 byte ptr [ebp - 0x38], 0

        $sequence_26 = { 55 8bec 51 a1???????? 8365fc00 83c03c }
            // n = 6, score = 200
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   51                   | push                ecx
            //   a1????????           |                     
            //   8365fc00             | and                 dword ptr [ebp - 4], 0
            //   83c03c               | add                 eax, 0x3c

        $sequence_27 = { 6a00 b9???????? 66c745e81800 8955fc ff45f4 894dfc }
            // n = 6, score = 200
            //   6a00                 | push                0
            //   b9????????           |                     
            //   66c745e81800         | mov                 word ptr [ebp - 0x18], 0x18
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   ff45f4               | inc                 dword ptr [ebp - 0xc]
            //   894dfc               | mov                 dword ptr [ebp - 4], ecx

    condition:
        7 of them and filesize < 2220032
}