rule win_pitou_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.pitou."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pitou"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c1e305 03c3 8bda c1eb02 }
            // n = 4, score = 700
            //   c1e305               | cmp                 dx, bx
            //   03c3                 | jne                 0x51a0
            //   8bda                 | mov                 ebx, 0x100
            //   c1eb02               | mov                 dword ptr [ebp - 0x14], edx

        $sequence_1 = { 8bc2 5e 5a 59 5b }
            // n = 5, score = 700
            //   8bc2                 | mov                 edx, dword ptr [ebp - 4]
            //   5e                   | mov                 ecx, dword ptr [edx + 0xdc]
            //   5a                   | mov                 dword ptr [ebp - 4], ecx
            //   59                   | test                ecx, ecx
            //   5b                   | jne                 0xfffeef1a

        $sequence_2 = { 80f457 8acc 80e103 8aec }
            // n = 4, score = 700
            //   80f457               | mov                 eax, edi
            //   8acc                 | push                0x11
            //   80e103               | push                eax
            //   8aec                 | mov                 eax, dword ptr [ebp + 0xc]

        $sequence_3 = { ac 8bda c1e305 03c3 }
            // n = 4, score = 700
            //   ac                   | lcall               0x6939:0x12e5357
            //   8bda                 | adc                 al, 7
            //   c1e305               | test                eax, 0x13a90313
            //   03c3                 | lcall               0x550a:0x242e5357

        $sequence_4 = { 8acc 80e103 8aec c0ed03 80e507 }
            // n = 5, score = 700
            //   8acc                 | mov                 byte ptr [esi + 0xa], dl
            //   80e103               | mov                 dl, al
            //   8aec                 | mov                 byte ptr [esi + 9], al
            //   c0ed03               | and                 dl, 7
            //   80e507               | shr                 al, 3

        $sequence_5 = { 8a12 80f257 8ada c0eb02 }
            // n = 4, score = 700
            //   8a12                 | jae                 0x879
            //   80f257               | mov                 dword ptr [ebp - 4], 0
            //   8ada                 | mov                 dword ptr [ebp - 0x190], edx
            //   c0eb02               | cmp                 dword ptr [ebp - 0x190], 0x6eb

        $sequence_6 = { 80e703 c0eb05 80e303 80ff00 }
            // n = 4, score = 700
            //   80e703               | lea                 eax, [edi + 0x200]
            //   c0eb05               | push                6
            //   80e303               | push                0x1010102
            //   80ff00               | lea                 edx, [esi + 0x200]

        $sequence_7 = { 33c0 ac 8bda c1e305 03c3 8bda }
            // n = 6, score = 700
            //   33c0                 | das                 
            //   ac                   | bound               ebp, qword ptr [ebx - 0x79cc960a]
            //   8bda                 | add                 ebx, dword ptr [edx - 0x5cac60ee]
            //   c1e305               | adc                 eax, 0x175a3324
            //   03c3                 | add                 ebx, dword ptr [edx + 0x139a3313]
            //   8bda                 | das                 

        $sequence_8 = { 8bda c1e305 03c3 8bda c1eb02 03c3 33d0 }
            // n = 7, score = 700
            //   8bda                 | jmp                 0x16e4
            //   c1e305               | mov                 eax, dword ptr [ebp - 0xf4]
            //   03c3                 | add                 eax, 0x17
            //   8bda                 | mov                 esp, ebp
            //   c1eb02               | mov                 eax, dword ptr [ebp - 0xf4]
            //   03c3                 | add                 eax, dword ptr [ebp + edx*4 - 0xf0]
            //   33d0                 | mov                 dword ptr [ebp - 0xf4], eax

        $sequence_9 = { 80f457 8acc 80e103 8aec c0ed03 }
            // n = 5, score = 700
            //   80f457               | jne                 0x68a9
            //   8acc                 | cmp                 dx, bx
            //   80e103               | jne                 0xffffd607
            //   8aec                 | shr                 edx, 0x10
            //   c0ed03               | cmp                 edx, ebx

    condition:
        7 of them and filesize < 1106944
}