rule win_nevada_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.nevada."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nevada"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 80f9df 7645 410fb66802 c1e706 83e53f 09fd 80fbf0 }
            // n = 7, score = 100
            //   80f9df               | add                 edx, 1
            //   7645                 | dec                 ecx
            //   410fb66802           | mov                 ebx, edx
            //   c1e706               | dec                 ecx
            //   83e53f               | cmp                 ebx, 0x1f
            //   09fd                 | ja                  0x8ca
            //   80fbf0               | inc                 ecx

        $sequence_1 = { 4d01ff 0f84fe000000 41b802000000 488b8d18060000 e9???????? 31db 4889c1 }
            // n = 7, score = 100
            //   4d01ff               | lea                 ecx, [eax + 1]
            //   0f84fe000000         | jmp                 0x34a
            //   41b802000000         | xor                 ebx, ebx
            //   488b8d18060000       | jmp                 0x353
            //   e9????????           |                     
            //   31db                 | dec                 esp
            //   4889c1               | mov                 ebx, eax

        $sequence_2 = { 4889c2 e9???????? 488d052e6f0300 41b80b000000 4889d1 4889c2 e9???????? }
            // n = 7, score = 100
            //   4889c2               | inc                 ecx
            //   e9????????           |                     
            //   488d052e6f0300       | shr                 ebp, 0x10
            //   41b80b000000         | inc                 ebp
            //   4889d1               | mov                 edi, ebp
            //   4889c2               | mov                 ebx, 4
            //   e9????????           |                     

        $sequence_3 = { 662e0f1f840000000000 90 488b3cc1 4c893f 8d3428 6689b720030000 4883c001 }
            // n = 7, score = 100
            //   662e0f1f840000000000     | paddb    mm2, mm2
            //   90                   | movdqa              xmm3, xmm2
            //   488b3cc1             | pminub              xmm3, xmm4
            //   4c893f               | pcmpeqb             xmm3, xmm2
            //   8d3428               | pand                xmm3, xmm5
            //   6689b720030000       | por                 xmm1, xmm2
            //   4883c001             | movdqu              xmmword ptr [ecx + 0x30], xmm1

        $sequence_4 = { 4531c0 84c9 488d05373d0200 488d152e3d0200 480f44d0 410f94c0 4983c802 }
            // n = 7, score = 100
            //   4531c0               | jne                 0x7ba
            //   84c9                 | inc                 ecx
            //   488d05373d0200       | mov                 eax, 0x250
            //   488d152e3d0200       | dec                 ecx
            //   480f44d0             | mov                 dword ptr [esi], 0
            //   410f94c0             | dec                 ebp
            //   4983c802             | mov                 dword ptr [esi + 8], edi

        $sequence_5 = { 750d 488b45f8 488d4808 e8???????? 488b75f8 488b5618 4885d2 }
            // n = 7, score = 100
            //   750d                 | mov                 eax, 1
            //   488b45f8             | dec                 eax
            //   488d4808             | mov                 ecx, esi
            //   e8????????           |                     
            //   488b75f8             | dec                 eax
            //   488b5618             | mov                 edx, edi
            //   4885d2               | jmp                 0xffffffb2

        $sequence_6 = { f048832801 7505 e9???????? c3 55 4883ec40 488d6c2440 }
            // n = 7, score = 100
            //   f048832801           | dec                 ecx
            //   7505                 | mov                 ebx, esi
            //   e9????????           |                     
            //   c3                   | jmp                 0x363
            //   55                   | inc                 ecx
            //   4883ec40             | test                ebp, 0xfffd
            //   488d6c2440           | je                  0x5fa

        $sequence_7 = { e8???????? 0f108560040000 0f2945e0 488b8570040000 488945f0 488b8520050000 49894610 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   0f108560040000       | dec                 eax
            //   0f2945e0             | lea                 eax, [0x3daa0]
            //   488b8570040000       | ud2                 
            //   488945f0             | dec                 eax
            //   488b8520050000       | lea                 eax, [0x3a63e]
            //   49894610             | dec                 eax

        $sequence_8 = { 8a07 4c8d05bb28fbff 4b8b8ce0e0b20700 ffc3 895d9b 428844f13e 4b8b84e0e0b20700 }
            // n = 7, score = 100
            //   8a07                 | mov                 dword ptr [esp + 0x40], eax
            //   4c8d05bb28fbff       | dec                 eax
            //   4b8b8ce0e0b20700     | lea                 eax, [0xffff9952]
            //   ffc3                 | dec                 eax
            //   895d9b               | mov                 dword ptr [esp + 0x48], eax
            //   428844f13e           | dec                 eax
            //   4b8b84e0e0b20700     | lea                 eax, [esp + 0x80]

        $sequence_9 = { b907000000 e8???????? 8bc7 eb8a 4863d1 4c8d0596110300 488bc2 }
            // n = 7, score = 100
            //   b907000000           | dec                 eax
            //   e8????????           |                     
            //   8bc7                 | mov                 edx, edi
            //   eb8a                 | dec                 eax
            //   4863d1               | cmp                 dword ptr [esp + 0x68], 5
            //   4c8d0596110300       | jne                 0x6e9
            //   488bc2               | dec                 eax

    condition:
        7 of them and filesize < 1063936
}