rule win_metadatabin_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.metadatabin."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metadatabin"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 89fb 89c7 758b 8b45f0 8b5510 8b4dec 39d8 }
            // n = 7, score = 100
            //   89fb                 | mov                 ebx, edi
            //   89c7                 | mov                 edi, eax
            //   758b                 | jne                 0xffffff8d
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   8b5510               | mov                 edx, dword ptr [ebp + 0x10]
            //   8b4dec               | mov                 ecx, dword ptr [ebp - 0x14]
            //   39d8                 | cmp                 eax, ebx

        $sequence_1 = { 8b5c2414 8b4c2418 31c0 01d9 894c2418 8d4c19ff 39f9 }
            // n = 7, score = 100
            //   8b5c2414             | mov                 ebx, dword ptr [esp + 0x14]
            //   8b4c2418             | mov                 ecx, dword ptr [esp + 0x18]
            //   31c0                 | xor                 eax, eax
            //   01d9                 | add                 ecx, ebx
            //   894c2418             | mov                 dword ptr [esp + 0x18], ecx
            //   8d4c19ff             | lea                 ecx, [ecx + ebx - 1]
            //   39f9                 | cmp                 ecx, edi

        $sequence_2 = { c1e105 01c1 fec0 f7d9 884724 80f909 726a }
            // n = 7, score = 100
            //   c1e105               | shl                 ecx, 5
            //   01c1                 | add                 ecx, eax
            //   fec0                 | inc                 al
            //   f7d9                 | neg                 ecx
            //   884724               | mov                 byte ptr [edi + 0x24], al
            //   80f909               | cmp                 cl, 9
            //   726a                 | jb                  0x6c

        $sequence_3 = { f7e3 8b5c2408 01c8 89842460010000 0fb6442418 11c2 89d8 }
            // n = 7, score = 100
            //   f7e3                 | mul                 ebx
            //   8b5c2408             | mov                 ebx, dword ptr [esp + 8]
            //   01c8                 | add                 eax, ecx
            //   89842460010000       | mov                 dword ptr [esp + 0x160], eax
            //   0fb6442418           | movzx               eax, byte ptr [esp + 0x18]
            //   11c2                 | adc                 edx, eax
            //   89d8                 | mov                 eax, ebx

        $sequence_4 = { c144240407 c1c007 c1c207 8944244c 89c8 89f9 8954242c }
            // n = 7, score = 100
            //   c144240407           | rol                 dword ptr [esp + 4], 7
            //   c1c007               | rol                 eax, 7
            //   c1c207               | rol                 edx, 7
            //   8944244c             | mov                 dword ptr [esp + 0x4c], eax
            //   89c8                 | mov                 eax, ecx
            //   89f9                 | mov                 ecx, edi
            //   8954242c             | mov                 dword ptr [esp + 0x2c], edx

        $sequence_5 = { f7e3 01f8 89d1 8b7c2440 89842418010000 8b442430 11f1 }
            // n = 7, score = 100
            //   f7e3                 | mul                 ebx
            //   01f8                 | add                 eax, edi
            //   89d1                 | mov                 ecx, edx
            //   8b7c2440             | mov                 edi, dword ptr [esp + 0x40]
            //   89842418010000       | mov                 dword ptr [esp + 0x118], eax
            //   8b442430             | mov                 eax, dword ptr [esp + 0x30]
            //   11f1                 | adc                 ecx, esi

        $sequence_6 = { 7426 01d0 8d341a 662e0f1f840000000000 6690 0fb618 40 }
            // n = 7, score = 100
            //   7426                 | je                  0x28
            //   01d0                 | add                 eax, edx
            //   8d341a               | lea                 esi, [edx + ebx]
            //   662e0f1f840000000000     | nop    word ptr cs:[eax + eax]
            //   6690                 | nop                 
            //   0fb618               | movzx               ebx, byte ptr [eax]
            //   40                   | inc                 eax

        $sequence_7 = { 89f7 8b75ec 89d3 8d14bd00000000 8b4808 8b4508 8d0481 }
            // n = 7, score = 100
            //   89f7                 | mov                 edi, esi
            //   8b75ec               | mov                 esi, dword ptr [ebp - 0x14]
            //   89d3                 | mov                 ebx, edx
            //   8d14bd00000000       | lea                 edx, [edi*4]
            //   8b4808               | mov                 ecx, dword ptr [eax + 8]
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d0481               | lea                 eax, [ecx + eax*4]

        $sequence_8 = { 8b8c2480020000 89542424 f7e1 898424d0010000 8b8424f0000000 89542420 f7e1 }
            // n = 7, score = 100
            //   8b8c2480020000       | mov                 ecx, dword ptr [esp + 0x280]
            //   89542424             | mov                 dword ptr [esp + 0x24], edx
            //   f7e1                 | mul                 ecx
            //   898424d0010000       | mov                 dword ptr [esp + 0x1d0], eax
            //   8b8424f0000000       | mov                 eax, dword ptr [esp + 0xf0]
            //   89542420             | mov                 dword ptr [esp + 0x20], edx
            //   f7e1                 | mul                 ecx

        $sequence_9 = { f20f11431c f20f114b24 8b45dc 89432c 31c0 894604 897e08 }
            // n = 7, score = 100
            //   f20f11431c           | movsd               qword ptr [ebx + 0x1c], xmm0
            //   f20f114b24           | movsd               qword ptr [ebx + 0x24], xmm1
            //   8b45dc               | mov                 eax, dword ptr [ebp - 0x24]
            //   89432c               | mov                 dword ptr [ebx + 0x2c], eax
            //   31c0                 | xor                 eax, eax
            //   894604               | mov                 dword ptr [esi + 4], eax
            //   897e08               | mov                 dword ptr [esi + 8], edi

    condition:
        7 of them and filesize < 1263616
}