rule win_kerrdown_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-08-17"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kerrdown"
        malpedia_rule_date = "20200817"
        malpedia_hash = "8c895fd01eccb47a6225bcb1a3ba53cbb98644c5"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 1bc0 23c1 eb55 8b1c9d48f23200 }
            // n = 4, score = 100
            //   1bc0                 | sbb                 eax, eax
            //   23c1                 | and                 eax, ecx
            //   eb55                 | jmp                 0x57
            //   8b1c9d48f23200       | mov                 ebx, dword ptr [ebx*4 + 0x32f248]

        $sequence_1 = { a7 8ade 2c2d 246d }
            // n = 4, score = 100
            //   a7                   | cmpsd               dword ptr [esi], dword ptr es:[edi]
            //   8ade                 | mov                 bl, dh
            //   2c2d                 | sub                 al, 0x2d
            //   246d                 | and                 al, 0x6d

        $sequence_2 = { 75b2 83ff10 8935???????? b8???????? }
            // n = 4, score = 100
            //   75b2                 | jne                 0xffffffb4
            //   83ff10               | cmp                 edi, 0x10
            //   8935????????         |                     
            //   b8????????           |                     

        $sequence_3 = { 8a01 41 884435e8 46 894de0 }
            // n = 5, score = 100
            //   8a01                 | mov                 al, byte ptr [ecx]
            //   41                   | inc                 ecx
            //   884435e8             | mov                 byte ptr [ebp + esi - 0x18], al
            //   46                   | inc                 esi
            //   894de0               | mov                 dword ptr [ebp - 0x20], ecx

        $sequence_4 = { 722b 83f923 772b 8bc8 }
            // n = 4, score = 100
            //   722b                 | jb                  0x2d
            //   83f923               | cmp                 ecx, 0x23
            //   772b                 | ja                  0x2d
            //   8bc8                 | mov                 ecx, eax

        $sequence_5 = { 3d00100000 721a f6c11f 752f }
            // n = 4, score = 100
            //   3d00100000           | cmp                 eax, 0x1000
            //   721a                 | jb                  0x1c
            //   f6c11f               | test                cl, 0x1f
            //   752f                 | jne                 0x31

        $sequence_6 = { 0f85ac0a0000 8d0d202e3300 ba1b000000 e9???????? }
            // n = 4, score = 100
            //   0f85ac0a0000         | jne                 0xab2
            //   8d0d202e3300         | lea                 ecx, [0x332e20]
            //   ba1b000000           | mov                 edx, 0x1b
            //   e9????????           |                     

        $sequence_7 = { 8b45e4 8b4de8 8b0485d8cc3300 f644082840 7409 803f1a }
            // n = 6, score = 100
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   8b4de8               | mov                 ecx, dword ptr [ebp - 0x18]
            //   8b0485d8cc3300       | mov                 eax, dword ptr [eax*4 + 0x33ccd8]
            //   f644082840           | test                byte ptr [eax + ecx + 0x28], 0x40
            //   7409                 | je                  0xb
            //   803f1a               | cmp                 byte ptr [edi], 0x1a

        $sequence_8 = { 02d1 c0e004 8855e4 33db }
            // n = 4, score = 100
            //   02d1                 | add                 dl, cl
            //   c0e004               | shl                 al, 4
            //   8855e4               | mov                 byte ptr [ebp - 0x1c], dl
            //   33db                 | xor                 ebx, ebx

        $sequence_9 = { 8bd6 83e03f c1fa06 6bc830 8b0495d8cc3300 }
            // n = 5, score = 100
            //   8bd6                 | mov                 edx, esi
            //   83e03f               | and                 eax, 0x3f
            //   c1fa06               | sar                 edx, 6
            //   6bc830               | imul                ecx, eax, 0x30
            //   8b0495d8cc3300       | mov                 eax, dword ptr [edx*4 + 0x33ccd8]

    condition:
        7 of them and filesize < 278528
}