rule win_onhat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.onhat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onhat"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 53 68???????? e8???????? 8b44244c 83c42c }
            // n = 5, score = 200
            //   53                   | push                ebx
            //   68????????           |                     
            //   e8????????           |                     
            //   8b44244c             | mov                 eax, dword ptr [esp + 0x4c]
            //   83c42c               | add                 esp, 0x2c

        $sequence_1 = { 6689442432 e8???????? 83c414 85c0 }
            // n = 4, score = 200
            //   6689442432           | mov                 word ptr [esp + 0x32], ax
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   85c0                 | test                eax, eax

        $sequence_2 = { 888c24a8010000 c68424a901000020 889424aa010000 c68424ac01000073 c68424ad01000020 c68424ae01000041 }
            // n = 6, score = 200
            //   888c24a8010000       | mov                 byte ptr [esp + 0x1a8], cl
            //   c68424a901000020     | mov                 byte ptr [esp + 0x1a9], 0x20
            //   889424aa010000       | mov                 byte ptr [esp + 0x1aa], dl
            //   c68424ac01000073     | mov                 byte ptr [esp + 0x1ac], 0x73
            //   c68424ad01000020     | mov                 byte ptr [esp + 0x1ad], 0x20
            //   c68424ae01000041     | mov                 byte ptr [esp + 0x1ae], 0x41

        $sequence_3 = { b020 884c241a b253 b145 88442417 }
            // n = 5, score = 200
            //   b020                 | mov                 al, 0x20
            //   884c241a             | mov                 byte ptr [esp + 0x1a], cl
            //   b253                 | mov                 dl, 0x53
            //   b145                 | mov                 cl, 0x45
            //   88442417             | mov                 byte ptr [esp + 0x17], al

        $sequence_4 = { e8???????? 85c0 7f0e 5f b803000080 5e 81c404010000 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7f0e                 | jg                  0x10
            //   5f                   | pop                 edi
            //   b803000080           | mov                 eax, 0x80000003
            //   5e                   | pop                 esi
            //   81c404010000         | add                 esp, 0x104

        $sequence_5 = { c68424ed0000004e c68424ee00000054 c68424ef00000041 c68424f000000048 889c24f1000000 c68424f200000045 c68424f30000004e }
            // n = 7, score = 200
            //   c68424ed0000004e     | mov                 byte ptr [esp + 0xed], 0x4e
            //   c68424ee00000054     | mov                 byte ptr [esp + 0xee], 0x54
            //   c68424ef00000041     | mov                 byte ptr [esp + 0xef], 0x41
            //   c68424f000000048     | mov                 byte ptr [esp + 0xf0], 0x48
            //   889c24f1000000       | mov                 byte ptr [esp + 0xf1], bl
            //   c68424f200000045     | mov                 byte ptr [esp + 0xf2], 0x45
            //   c68424f30000004e     | mov                 byte ptr [esp + 0xf3], 0x4e

        $sequence_6 = { 0f87bc010000 ff2485c8444000 8b542444 6685d2 }
            // n = 4, score = 200
            //   0f87bc010000         | ja                  0x1c2
            //   ff2485c8444000       | jmp                 dword ptr [eax*4 + 0x4044c8]
            //   8b542444             | mov                 edx, dword ptr [esp + 0x44]
            //   6685d2               | test                dx, dx

        $sequence_7 = { 81c40c010000 c3 8b842420010000 8b8c241c010000 25ffff0000 }
            // n = 5, score = 200
            //   81c40c010000         | add                 esp, 0x10c
            //   c3                   | ret                 
            //   8b842420010000       | mov                 eax, dword ptr [esp + 0x120]
            //   8b8c241c010000       | mov                 ecx, dword ptr [esp + 0x11c]
            //   25ffff0000           | and                 eax, 0xffff

        $sequence_8 = { 8d7c2409 88542408 f3ab 8b8c240c200000 88542406 66ab }
            // n = 6, score = 200
            //   8d7c2409             | lea                 edi, [esp + 9]
            //   88542408             | mov                 byte ptr [esp + 8], dl
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   8b8c240c200000       | mov                 ecx, dword ptr [esp + 0x200c]
            //   88542406             | mov                 byte ptr [esp + 6], dl
            //   66ab                 | stosw               word ptr es:[edi], ax

        $sequence_9 = { c3 b814110000 e8???????? 8b8c2420110000 b8d34d6210 f7e1 }
            // n = 6, score = 200
            //   c3                   | ret                 
            //   b814110000           | mov                 eax, 0x1114
            //   e8????????           |                     
            //   8b8c2420110000       | mov                 ecx, dword ptr [esp + 0x1120]
            //   b8d34d6210           | mov                 eax, 0x10624dd3
            //   f7e1                 | mul                 ecx

    condition:
        7 of them and filesize < 57344
}