rule win_nikihttp_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.nikihttp."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nikihttp"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b8cd883d4e e9???????? 488b442418 440fbe10 448a19 baac654b2b 662e0f1f840000000000 }
            // n = 7, score = 100
            //   b8cd883d4e           | nop                 dword ptr [eax + eax]
            //   e9????????           |                     
            //   488b442418           | cmp                 edx, 0x45c64127
            //   440fbe10             | je                  0x1e5d
            //   448a19               | cmp                 edx, 0x66a53b08
            //   baac654b2b           | add                 dx, cx
            //   662e0f1f840000000000     | mov    word ptr [eax + 0x2e], dx

        $sequence_1 = { b94e093caa 662e0f1f840000000000 90 81f94e093caa 740d 81f96096f6ba 75f0 }
            // n = 7, score = 100
            //   b94e093caa           | cmp                 ebx, 0x570db4c6
            //   662e0f1f840000000000     | je    0xbdb
            //   90                   | cmp                 ebx, 0xbed44fb9
            //   81f94e093caa         | jne                 0xa84
            //   740d                 | mov                 ebx, 0x690a3a4
            //   81f96096f6ba         | nop                 word ptr cs:[eax + eax]
            //   75f0                 | nop                 

        $sequence_2 = { e8???????? 4883c420 b8379018ee ebcf b8b8b03320 e9???????? b81225616d }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4883c420             | jne                 0x675
            //   b8379018ee           | mov                 byte ptr [eax + esi], 0
            //   ebcf                 | mov                 ecx, 0x57b489e6
            //   b8b8b03320           | jmp                 0x675
            //   e9????????           |                     
            //   b81225616d           | cmp                 ecx, 0x57b489e6

        $sequence_3 = { b9a9d0223e e9???????? 8b0d???????? 8b15???????? 8d79ff 0faff9 be73a2e45a }
            // n = 7, score = 100
            //   b9a9d0223e           | mov                 ebx, 0xfa6b2617
            //   e9????????           |                     
            //   8b0d????????         |                     
            //   8b15????????         |                     
            //   8d79ff               | jmp                 0x14d
            //   0faff9               | mov                 word ptr [ecx], 0
            //   be73a2e45a           | dec                 eax

        $sequence_4 = { ba6f8782a3 662e0f1f840000000000 81fab24ff80a 0f84f1000000 81fa6f8782a3 75ec b9204d1a23 }
            // n = 7, score = 100
            //   ba6f8782a3           | jne                 0x59a
            //   662e0f1f840000000000     | movzx    eax, byte ptr [esp + 0x24]
            //   81fab24ff80a         | cmp                 byte ptr [esp + 0x38], 0
            //   0f84f1000000         | je                  0x615
            //   81fa6f8782a3         | cmp                 esi, 0xe3b13d60
            //   75ec                 | je                  0x435
            //   b9204d1a23           | cmp                 esi, 0xdb7f0c97

        $sequence_5 = { ba1e8b5751 41ba820d9735 410f4cd2 85f6 b81e8b5751 0f45d0 bb1e8b5751 }
            // n = 7, score = 100
            //   ba1e8b5751           | je                  0xac3
            //   41ba820d9735         | cmp                 ecx, 0xbcddb5d3
            //   410f4cd2             | jne                 0xa73
            //   85f6                 | jmp                 0xac7
            //   b81e8b5751           | mov                 ecx, 0x32dd4290
            //   0f45d0               | jmp                 0xa73
            //   bb1e8b5751           | mov                 ecx, 0xbcddb5d3

        $sequence_6 = { ba77b351f3 0f1f8000000000 81fa1914cb1d 7454 81fa77b351f3 75f0 8b4c2450 }
            // n = 7, score = 100
            //   ba77b351f3           | dec                 eax
            //   0f1f8000000000       | movsx               eax, byte ptr [eax]
            //   81fa1914cb1d         | dec                 eax
            //   7454                 | add                 eax, 3
            //   81fa77b351f3         | dec                 eax
            //   75f0                 | mov                 dword ptr [ebp], eax
            //   8b4c2450             | je                  0xe18

        $sequence_7 = { ebde 88442430 8a442430 888424bb000000 c744245065000000 b8f1f3ead5 6690 }
            // n = 7, score = 100
            //   ebde                 | dec                 eax
            //   88442430             | sub                 esp, 0x20
            //   8a442430             | mov                 byte ptr [ecx], al
            //   888424bb000000       | mov                 eax, 0xedbc5410
            //   c744245065000000     | cmp                 eax, 0xa1cb0643
            //   b8f1f3ead5           | jne                 0x1440
            //   6690                 | dec                 eax

        $sequence_8 = { 80bdd600000000 b94b1fe2e9 ba2cb032ae 0f45ca 84db 0f45ca e9???????? }
            // n = 7, score = 100
            //   80bdd600000000       | mov                 edi, 0x3fe8abd3
            //   b94b1fe2e9           | inc                 ecx
            //   ba2cb032ae           | mov                 esp, 0x717d4d66
            //   0f45ca               | jmp                 0x1da6
            //   84db                 | mov                 edx, 0x55bf6f2
            //   0f45ca               | inc                 ecx
            //   e9????????           |                     

        $sequence_9 = { eb37 baf87f0f40 ebe7 488b9d10010000 339d0c010000 66895a14 bb55995cda }
            // n = 7, score = 100
            //   eb37                 | cmp                 edi, 0xad81cde9
            //   baf87f0f40           | je                  0xdf2
            //   ebe7                 | cmp                 edi, 0xadd2b767
            //   488b9d10010000       | cmp                 edi, 0x5fe275b0
            //   339d0c010000         | je                  0xe18
            //   66895a14             | cmp                 edi, 0xf5544c86
            //   bb55995cda           | je                  0xf49

    condition:
        7 of them and filesize < 2543616
}