rule win_mulcom_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.mulcom."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mulcom"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7596 b9e8000000 e8???????? 488bf8 4889442430 488d4818 ff15???????? }
            // n = 7, score = 100
            //   7596                 | je                  0x15aa
            //   b9e8000000           | dec                 eax
            //   e8????????           |                     
            //   488bf8               | mov                 ecx, eax
            //   4889442430           | dec                 eax
            //   488d4818             | mov                 edi, eax
            //   ff15????????         |                     

        $sequence_1 = { 488bf9 4885db 0f849c000000 488b7108 483bde 7433 488d4b68 }
            // n = 7, score = 100
            //   488bf9               | mov                 edx, dword ptr [ebp - 9]
            //   4885db               | inc                 esp
            //   0f849c000000         | add                 cl, al
            //   488b7108             | inc                 ecx
            //   483bde               | movzx               edx, cl
            //   7433                 | xor                 al, byte ptr [esp + edx + 0x20]
            //   488d4b68             | mov                 byte ptr [esp + ecx + 0x20], al

        $sequence_2 = { 4889442430 488d4818 ff15???????? 488d4f40 ff15???????? 44897768 4c897770 }
            // n = 7, score = 100
            //   4889442430           | mov                 dword ptr [ebx], esi
            //   488d4818             | dec                 esp
            //   ff15????????         |                     
            //   488d4f40             | mov                 dword ptr [ebx + 8], esi
            //   ff15????????         |                     
            //   44897768             | nop                 
            //   4c897770             | movdqu              xmmword ptr [ebp - 0x40], xmm0

        $sequence_3 = { 4885d2 7408 488b4650 8b08 eb02 33c9 4863c1 }
            // n = 7, score = 100
            //   4885d2               | dec                 eax
            //   7408                 | mov                 eax, ecx
            //   488b4650             | dec                 eax
            //   8b08                 | mov                 ecx, dword ptr [ecx + 8]
            //   eb02                 | cmp                 byte ptr [ecx + 0x19], 0
            //   33c9                 | jmp                 0xd2e
            //   4863c1               | dec                 eax

        $sequence_4 = { 4d85f6 7460 41832600 498b4e08 4885c9 7412 41837e1000 }
            // n = 7, score = 100
            //   4d85f6               | dec                 esp
            //   7460                 | mov                 esi, edx
            //   41832600             | dec                 eax
            //   498b4e08             | mov                 esi, ecx
            //   4885c9               | dec                 eax
            //   7412                 | lea                 ecx, [esp + 0x30]
            //   41837e1000           | dec                 eax

        $sequence_5 = { 48837dd010 4c0f4345b8 40887c2428 4c89642420 448bc9 488b542430 488b0d???????? }
            // n = 7, score = 100
            //   48837dd010           | lea                 ecx, [esp + 0x28]
            //   4c0f4345b8           | int3                
            //   40887c2428           | dec                 eax
            //   4c89642420           | mov                 dword ptr [esp + 8], ebx
            //   448bc9               | dec                 eax
            //   488b542430           | lea                 edx, [0x579b3]
            //   488b0d????????       |                     

        $sequence_6 = { 423a840ac4870400 0f85c8000000 48ff4310 48837b0800 488b4310 7406 }
            // n = 6, score = 100
            //   423a840ac4870400     | add                 ebx, 0x88
            //   0f85c8000000         | dec                 eax
            //   48ff4310             | lea                 eax, [ebx - 0x48]
            //   48837b0800           | dec                 eax
            //   488b4310             | cmp                 eax, edi
            //   7406                 | jne                 0xa29

        $sequence_7 = { 0f11459f 0f104810 0f114daf 4c896010 48c740180f000000 448820 4c8bc7 }
            // n = 7, score = 100
            //   0f11459f             | dec                 eax
            //   0f104810             | mov                 edi, dword ptr [edx]
            //   0f114daf             | inc                 ecx
            //   4c896010             | mov                 esi, ebp
            //   48c740180f000000     | inc                 ebp
            //   448820               | cmp                 dword ptr [eax + 4], ebp
            //   4c8bc7               | jbe                 0x1a43

        $sequence_8 = { 48c1f803 4885c0 7410 488d41f8 488b38 488905???????? eb1b }
            // n = 7, score = 100
            //   48c1f803             | mov                 dword ptr [ebp - 0x50], edx
            //   4885c0               | dec                 esp
            //   7410                 | mov                 dword ptr [ebp - 0x50], eax
            //   488d41f8             | and                 dword ptr [esp + 0x20], 0
            //   488b38               | dec                 eax
            //   488905????????       |                     
            //   eb1b                 | xor                 eax, esp

        $sequence_9 = { eb03 40b701 488bce ff15???????? 488bcd ff15???????? 408ac7 }
            // n = 7, score = 100
            //   eb03                 | lea                 ecx, [edx + 0x120]
            //   40b701               | dec                 eax
            //   488bce               | lea                 ecx, [edx + 0x140]
            //   ff15????????         |                     
            //   488bcd               | dec                 eax
            //   ff15????????         |                     
            //   408ac7               | lea                 ecx, [edx + 0x120]

    condition:
        7 of them and filesize < 867328
}