rule win_pipemagic_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.pipemagic."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemagic"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffd6 8b5df0 57 668903 ffd6 59 }
            // n = 6, score = 100
            //   ffd6                 | call                esi
            //   8b5df0               | mov                 ebx, dword ptr [ebp - 0x10]
            //   57                   | push                edi
            //   668903               | mov                 word ptr [ebx], ax
            //   ffd6                 | call                esi
            //   59                   | pop                 ecx

        $sequence_1 = { ff36 53 ff15???????? 85c0 0f84b0000000 8b45f0 }
            // n = 6, score = 100
            //   ff36                 | push                dword ptr [esi]
            //   53                   | push                ebx
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f84b0000000         | je                  0xb6
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]

        $sequence_2 = { 83f820 0fb6ca 1bf6 23f0 0fb68600804000 03c7 03c8 }
            // n = 7, score = 100
            //   83f820               | cmp                 eax, 0x20
            //   0fb6ca               | movzx               ecx, dl
            //   1bf6                 | sbb                 esi, esi
            //   23f0                 | and                 esi, eax
            //   0fb68600804000       | movzx               eax, byte ptr [esi + 0x408000]
            //   03c7                 | add                 eax, edi
            //   03c8                 | add                 ecx, eax

        $sequence_3 = { 03c7 03c8 0fb6f9 8a843df0feffff 88841df0feffff 43 }
            // n = 6, score = 100
            //   03c7                 | add                 eax, edi
            //   03c8                 | add                 ecx, eax
            //   0fb6f9               | movzx               edi, cl
            //   8a843df0feffff       | mov                 al, byte ptr [ebp + edi - 0x110]
            //   88841df0feffff       | mov                 byte ptr [ebp + ebx - 0x110], al
            //   43                   | inc                 ebx

        $sequence_4 = { 8bd9 57 6a04 8b730c 8bce e8???????? 85c0 }
            // n = 7, score = 100
            //   8bd9                 | mov                 ebx, ecx
            //   57                   | push                edi
            //   6a04                 | push                4
            //   8b730c               | mov                 esi, dword ptr [ebx + 0xc]
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   85c0                 | test                eax, eax

        $sequence_5 = { e8???????? 8b1d???????? 57 ffd3 8d4c2410 e8???????? 8d4c2410 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b1d????????         |                     
            //   57                   | push                edi
            //   ffd3                 | call                ebx
            //   8d4c2410             | lea                 ecx, [esp + 0x10]
            //   e8????????           |                     
            //   8d4c2410             | lea                 ecx, [esp + 0x10]

        $sequence_6 = { 8b4b0c e8???????? 85c0 7404 8b00 eb03 8b45f8 }
            // n = 7, score = 100
            //   8b4b0c               | mov                 ecx, dword ptr [ebx + 0xc]
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7404                 | je                  6
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   eb03                 | jmp                 5
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]

        $sequence_7 = { 33ff 47 eb2e 8b45dc 8bc8 48 8945dc }
            // n = 7, score = 100
            //   33ff                 | xor                 edi, edi
            //   47                   | inc                 edi
            //   eb2e                 | jmp                 0x30
            //   8b45dc               | mov                 eax, dword ptr [ebp - 0x24]
            //   8bc8                 | mov                 ecx, eax
            //   48                   | dec                 eax
            //   8945dc               | mov                 dword ptr [ebp - 0x24], eax

        $sequence_8 = { 8b4dfc 3bca 0f8709010000 2bd1 8955e4 8b55e0 85c9 }
            // n = 7, score = 100
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   3bca                 | cmp                 ecx, edx
            //   0f8709010000         | ja                  0x10f
            //   2bd1                 | sub                 edx, ecx
            //   8955e4               | mov                 dword ptr [ebp - 0x1c], edx
            //   8b55e0               | mov                 edx, dword ptr [ebp - 0x20]
            //   85c9                 | test                ecx, ecx

        $sequence_9 = { 59 84c0 7430 a1???????? 8d4f14 894604 c706???????? }
            // n = 7, score = 100
            //   59                   | pop                 ecx
            //   84c0                 | test                al, al
            //   7430                 | je                  0x32
            //   a1????????           |                     
            //   8d4f14               | lea                 ecx, [edi + 0x14]
            //   894604               | mov                 dword ptr [esi + 4], eax
            //   c706????????         |                     

    condition:
        7 of them and filesize < 87040
}