rule win_neutrino_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2018-11-23"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.1a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino"
        malpedia_version = "20180607"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach will be published in the near future here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { 81f900010000 72d9 8b7508 8b7d0c }
            // n = 4, score = 13000
            //   81f900010000         | cmp                 ecx, 0x100
            //   72d9                 | jb                  0x4027f6
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   8b7d0c               | mov                 edi, dword ptr [ebp + 0xc]

        $sequence_1 = { eb07 d1e8 352083b8ed e2ec }
            // n = 4, score = 13000
            //   eb07                 | jmp                 0x402810
            //   d1e8                 | shr                 eax, 1
            //   352083b8ed           | xor                 eax, 0xedb88320
            //   e2ec                 | loop                0x4027fe

        $sequence_2 = { bbffffffff 51 33c0 ac }
            // n = 4, score = 13000
            //   bbffffffff           | mov                 ebx, 0xffffffff
            //   51                   | push                ecx
            //   33c0                 | xor                 eax, eax
            //   ac                   | lodsb               al, byte ptr [esi]

        $sequence_3 = { b904000000 f7e1 93 8b45fc }
            // n = 4, score = 13000
            //   b904000000           | mov                 ecx, 4
            //   f7e1                 | mul                 ecx
            //   93                   | xchg                eax, ebx
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_4 = { b908000000 8bd0 83e201 7504 }
            // n = 4, score = 13000
            //   b908000000           | mov                 ecx, 8
            //   8bd0                 | mov                 edx, eax
            //   83e201               | and                 edx, 1
            //   7504                 | jne                 0x402809

        $sequence_5 = { 8bd8 59 41 3bcf }
            // n = 4, score = 13000
            //   8bd8                 | mov                 ebx, eax
            //   59                   | pop                 ecx
            //   41                   | inc                 ecx
            //   3bcf                 | cmp                 ecx, edi

        $sequence_6 = { d1e8 352083b8ed e2ec ab }
            // n = 4, score = 13000
            //   d1e8                 | shr                 eax, 1
            //   352083b8ed           | xor                 eax, 0xedb88320
            //   e2ec                 | loop                0x4027fe
            //   ab                   | stosd               dword ptr es:[edi], eax

        $sequence_7 = { 8bd3 c1eb08 53 87d3 }
            // n = 4, score = 13000
            //   8bd3                 | mov                 edx, ebx
            //   c1eb08               | shr                 ebx, 8
            //   53                   | push                ebx
            //   87d3                 | xchg                ebx, edx

        $sequence_8 = { 8b00 5b 33c3 8bd8 }
            // n = 4, score = 13000
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   5b                   | pop                 ebx
            //   33c3                 | xor                 eax, ebx
            //   8bd8                 | mov                 ebx, eax

        $sequence_9 = { ac 8bd3 c1eb08 53 }
            // n = 4, score = 13000
            //   ac                   | lodsb               al, byte ptr [esi]
            //   8bd3                 | mov                 edx, ebx
            //   c1eb08               | shr                 ebx, 8
            //   53                   | push                ebx

    condition:
        7 of them
}