rule win_lambert_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.lambert."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambert"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 33d1 33da 8970f0 8958fc 8948f4 8950f8 5f }
            // n = 7, score = 300
            //   33d1                 | xor                 edx, ecx
            //   33da                 | xor                 ebx, edx
            //   8970f0               | mov                 dword ptr [eax - 0x10], esi
            //   8958fc               | mov                 dword ptr [eax - 4], ebx
            //   8948f4               | mov                 dword ptr [eax - 0xc], ecx
            //   8950f8               | mov                 dword ptr [eax - 8], edx
            //   5f                   | pop                 edi

        $sequence_1 = { 3b7d10 0f82bd000000 3bf9 0f83b5000000 2bd9 8d4602 3bd8 }
            // n = 7, score = 300
            //   3b7d10               | cmp                 edi, dword ptr [ebp + 0x10]
            //   0f82bd000000         | jb                  0xc3
            //   3bf9                 | cmp                 edi, ecx
            //   0f83b5000000         | jae                 0xbb
            //   2bd9                 | sub                 ebx, ecx
            //   8d4602               | lea                 eax, [esi + 2]
            //   3bd8                 | cmp                 ebx, eax

        $sequence_2 = { ebce 8b45f8 8be5 5d c20400 55 }
            // n = 6, score = 300
            //   ebce                 | jmp                 0xffffffd0
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c20400               | ret                 4
            //   55                   | push                ebp

        $sequence_3 = { 05f0000000 832000 33f2 8b55e8 }
            // n = 4, score = 300
            //   05f0000000           | add                 eax, 0xf0
            //   832000               | and                 dword ptr [eax], 0
            //   33f2                 | xor                 esi, edx
            //   8b55e8               | mov                 edx, dword ptr [ebp - 0x18]

        $sequence_4 = { 0f8c1fffffff 8b07 8901 6a04 }
            // n = 4, score = 300
            //   0f8c1fffffff         | jl                  0xffffff25
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   8901                 | mov                 dword ptr [ecx], eax
            //   6a04                 | push                4

        $sequence_5 = { 83ec1c c745ec00000000 8b4508 8945f8 8b4df8 0fb711 81fa4d5a0000 }
            // n = 7, score = 300
            //   83ec1c               | sub                 esp, 0x1c
            //   c745ec00000000       | mov                 dword ptr [ebp - 0x14], 0
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   0fb711               | movzx               edx, word ptr [ecx]
            //   81fa4d5a0000         | cmp                 edx, 0x5a4d

        $sequence_6 = { 8b421c 8945f4 8b4df4 894df0 8b55f4 8b4220 }
            // n = 6, score = 300
            //   8b421c               | mov                 eax, dword ptr [edx + 0x1c]
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   894df0               | mov                 dword ptr [ebp - 0x10], ecx
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   8b4220               | mov                 eax, dword ptr [edx + 0x20]

        $sequence_7 = { 8b4d0c 8b5508 035124 8955f8 c745fc00000000 }
            // n = 5, score = 300
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   035124               | add                 edx, dword ptr [ecx + 0x24]
            //   8955f8               | mov                 dword ptr [ebp - 8], edx
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0

        $sequence_8 = { 8b55f8 c1e213 0bca 894df8 8b45fc 0fbe08 034df8 }
            // n = 7, score = 300
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]
            //   c1e213               | shl                 edx, 0x13
            //   0bca                 | or                  ecx, edx
            //   894df8               | mov                 dword ptr [ebp - 8], ecx
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   0fbe08               | movsx               ecx, byte ptr [eax]
            //   034df8               | add                 ecx, dword ptr [ebp - 8]

        $sequence_9 = { 3bd8 0f826f010000 8a07 8801 }
            // n = 4, score = 300
            //   3bd8                 | cmp                 ebx, eax
            //   0f826f010000         | jb                  0x175
            //   8a07                 | mov                 al, byte ptr [edi]
            //   8801                 | mov                 byte ptr [ecx], al

        $sequence_10 = { 0fb702 85c0 7428 8b4df8 }
            // n = 4, score = 300
            //   0fb702               | movzx               eax, word ptr [edx]
            //   85c0                 | test                eax, eax
            //   7428                 | je                  0x2a
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]

        $sequence_11 = { 8b4d08 03481c 894de4 8b55f4 8b45e4 8b4d08 }
            // n = 6, score = 300
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   03481c               | add                 ecx, dword ptr [eax + 0x1c]
            //   894de4               | mov                 dword ptr [ebp - 0x1c], ecx
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]

        $sequence_12 = { 3b7d10 724d 3bf9 7349 8bc3 2bc1 }
            // n = 6, score = 300
            //   3b7d10               | cmp                 edi, dword ptr [ebp + 0x10]
            //   724d                 | jb                  0x4f
            //   3bf9                 | cmp                 edi, ecx
            //   7349                 | jae                 0x4b
            //   8bc3                 | mov                 eax, ebx
            //   2bc1                 | sub                 eax, ecx

        $sequence_13 = { 0f8208010000 803a00 74e6 0fb602 }
            // n = 4, score = 300
            //   0f8208010000         | jb                  0x10e
            //   803a00               | cmp                 byte ptr [edx], 0
            //   74e6                 | je                  0xffffffe8
            //   0fb602               | movzx               eax, byte ptr [edx]

        $sequence_14 = { 8955f4 8b45f4 50 e8???????? 8945e8 8b4de8 3b4d10 }
            // n = 7, score = 300
            //   8955f4               | mov                 dword ptr [ebp - 0xc], edx
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   50                   | push                eax
            //   e8????????           |                     
            //   8945e8               | mov                 dword ptr [ebp - 0x18], eax
            //   8b4de8               | mov                 ecx, dword ptr [ebp - 0x18]
            //   3b4d10               | cmp                 ecx, dword ptr [ebp + 0x10]

        $sequence_15 = { 03f8 4e 4e 8b1f 8919 2bf0 03c8 }
            // n = 7, score = 300
            //   03f8                 | add                 edi, eax
            //   4e                   | dec                 esi
            //   4e                   | dec                 esi
            //   8b1f                 | mov                 ebx, dword ptr [edi]
            //   8919                 | mov                 dword ptr [ecx], ebx
            //   2bf0                 | sub                 esi, eax
            //   03c8                 | add                 ecx, eax

    condition:
        7 of them and filesize < 1205248
}