rule win_payloadbin_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.payloadbin."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.payloadbin"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6641f7c3503b 3bc7 e9???????? 0f8578000000 488b4c2430 660fca 4d0fb7cb }
            // n = 7, score = 100
            //   6641f7c3503b         | cmp                 eax, ebx
            //   3bc7                 | je                  0x70b
            //   e9????????           |                     
            //   0f8578000000         | dec                 eax
            //   488b4c2430           | lea                 edi, [ebx + eax]
            //   660fca               | clc                 
            //   4d0fb7cb             | mov                 ecx, dword ptr [edi]

        $sequence_1 = { 488bb42480000000 81ff41628163 e9???????? 483bf7 0f8408010000 488bee }
            // n = 6, score = 100
            //   488bb42480000000     | dec                 eax
            //   81ff41628163         | movsx               edi, bx
            //   e9????????           |                     
            //   483bf7               | dec                 ecx
            //   0f8408010000         | mov                 esp, ebx
            //   488bee               | inc                 ecx

        $sequence_2 = { 68eb3a8171 55 68396f8656 6819276b5f 682109a155 4c8b6c2438 48c7442438404fa1db }
            // n = 7, score = 100
            //   68eb3a8171           | movsx               edi, dl
            //   55                   | pop                 edi
            //   68396f8656           | ret                 
            //   6819276b5f           | dec                 eax
            //   682109a155           | mov                 dword ptr [esp + 0x18], ebx
            //   4c8b6c2438           | dec                 eax
            //   48c7442438404fa1db     | nop    

        $sequence_3 = { e9???????? bb03000000 4533e4 413bdc e9???????? 0f85a3060000 488b4c2430 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   bb03000000           | inc                 ecx
            //   4533e4               | cmp                 dh, 0x31
            //   413bdc               | mov                 word ptr [edi + eax*2], cx
            //   e9????????           |                     
            //   0f85a3060000         | inc                 eax
            //   488b4c2430           | test                ah, dh

        $sequence_4 = { 4c3be5 e9???????? 0f85acffffff 85f6 e9???????? 0f841e000000 }
            // n = 6, score = 100
            //   4c3be5               | lea                 ebx, [esi + 2]
            //   e9????????           |                     
            //   0f85acffffff         | clc                 
            //   85f6                 | inc                 cx
            //   e9????????           |                     
            //   0f841e000000         | test                edi, edx

        $sequence_5 = { 4d8b01 66c1e218 66418b10 f9 40fec7 493bc4 4981c106000000 }
            // n = 7, score = 100
            //   4d8b01               | ror                 dx, 0x9e
            //   66c1e218             | dec                 eax
            //   66418b10             | sal                 edx, 0x24
            //   f9                   | clc                 
            //   40fec7               | inc                 ebp
            //   493bc4               | mov                 dword ptr [ecx + 0x20], eax
            //   4981c106000000       | xor                 ecx, eax

        $sequence_6 = { 80bc24100000003d 4155 488184241000000033139340 4c8bac2418000000 688071f060 66c1b42400000000d9 0f8588950100 }
            // n = 7, score = 100
            //   80bc24100000003d     | dec                 ecx
            //   4155                 | arpl                bp, ax
            //   488184241000000033139340     | dec    ebp
            //   4c8bac2418000000     | bts                 ebx, eax
            //   688071f060           | mov                 eax, ecx
            //   66c1b42400000000d9     | ror    eax, 8
            //   0f8588950100         | and                 eax, edi

        $sequence_7 = { 8d56d4 fa 158935079e 9e 4657 250543b1d9 f661fd }
            // n = 7, score = 100
            //   8d56d4               | mov                 ebx, dword ptr [esp + 0x30]
            //   fa                   | sal                 dword ptr [esp + 0x30], 0xd0
            //   158935079e           | dec                 eax
            //   9e                   | and                 ebx, 0x5bf8481c
            //   4657                 | cmp                 ebx, dword ptr [esp]
            //   250543b1d9           | sal                 bl, 0x68
            //   f661fd               | dec                 eax

        $sequence_8 = { 440fb7c1 4080fca3 6683f819 e9???????? 0f8703000000 4503c5 0fb703 }
            // n = 7, score = 100
            //   440fb7c1             | cmp                 eax, ebp
            //   4080fca3             | je                  0x97b
            //   6683f819             | sub                 edx, edx
            //   e9????????           |                     
            //   0f8703000000         | inc                 ecx
            //   4503c5               | sbb                 al, 0xfb
            //   0fb703               | inc                 ecx

        $sequence_9 = { 4881842408000000dbb6ecff 5d c3 8084241000000078 e8???????? 68bc6baf1f }
            // n = 6, score = 100
            //   4881842408000000dbb6ecff     | inc    ecx
            //   5d                   | inc                 al
            //   c3                   | inc                 ecx
            //   8084241000000078     | bswap               ebx
            //   e8????????           |                     
            //   68bc6baf1f           | inc                 eax

    condition:
        7 of them and filesize < 3761152
}