rule win_r980_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.r980."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r980"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff5028 8bc8 c645fc04 e8???????? 8d4dd8 c645fc03 e8???????? }
            // n = 7, score = 200
            //   ff5028               | call                dword ptr [eax + 0x28]
            //   8bc8                 | mov                 ecx, eax
            //   c645fc04             | mov                 byte ptr [ebp - 4], 4
            //   e8????????           |                     
            //   8d4dd8               | lea                 ecx, dword ptr [ebp - 0x28]
            //   c645fc03             | mov                 byte ptr [ebp - 4], 3
            //   e8????????           |                     

        $sequence_1 = { 33c0 c745f807000000 56 895df4 668945e4 e8???????? 837df808 }
            // n = 7, score = 200
            //   33c0                 | xor                 eax, eax
            //   c745f807000000       | mov                 dword ptr [ebp - 8], 7
            //   56                   | push                esi
            //   895df4               | mov                 dword ptr [ebp - 0xc], ebx
            //   668945e4             | mov                 word ptr [ebp - 0x1c], ax
            //   e8????????           |                     
            //   837df808             | cmp                 dword ptr [ebp - 8], 8

        $sequence_2 = { 8945a8 8b4510 8945ac 8d45b8 50 895da4 e8???????? }
            // n = 7, score = 200
            //   8945a8               | mov                 dword ptr [ebp - 0x58], eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   8945ac               | mov                 dword ptr [ebp - 0x54], eax
            //   8d45b8               | lea                 eax, dword ptr [ebp - 0x48]
            //   50                   | push                eax
            //   895da4               | mov                 dword ptr [ebp - 0x5c], ebx
            //   e8????????           |                     

        $sequence_3 = { 51 e8???????? 57 8d4d0c e8???????? c745fc06000000 8b7510 }
            // n = 7, score = 200
            //   51                   | push                ecx
            //   e8????????           |                     
            //   57                   | push                edi
            //   8d4d0c               | lea                 ecx, dword ptr [ebp + 0xc]
            //   e8????????           |                     
            //   c745fc06000000       | mov                 dword ptr [ebp - 4], 6
            //   8b7510               | mov                 esi, dword ptr [ebp + 0x10]

        $sequence_4 = { 83e03f 6bd830 59 59 031cb5f0285200 f6432880 7446 }
            // n = 7, score = 200
            //   83e03f               | and                 eax, 0x3f
            //   6bd830               | imul                ebx, eax, 0x30
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx
            //   031cb5f0285200       | add                 ebx, dword ptr [esi*4 + 0x5228f0]
            //   f6432880             | test                byte ptr [ebx + 0x28], 0x80
            //   7446                 | je                  0x48

        $sequence_5 = { 64a300000000 894dec c745e800000000 c745fc01000000 8b5d10 68???????? 8b7b14 }
            // n = 7, score = 200
            //   64a300000000         | mov                 dword ptr fs:[0], eax
            //   894dec               | mov                 dword ptr [ebp - 0x14], ecx
            //   c745e800000000       | mov                 dword ptr [ebp - 0x18], 0
            //   c745fc01000000       | mov                 dword ptr [ebp - 4], 1
            //   8b5d10               | mov                 ebx, dword ptr [ebp + 0x10]
            //   68????????           |                     
            //   8b7b14               | mov                 edi, dword ptr [ebx + 0x14]

        $sequence_6 = { e8???????? ff7308 8b4dd0 ff75c8 e8???????? 8b4dd8 83c920 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   ff7308               | push                dword ptr [ebx + 8]
            //   8b4dd0               | mov                 ecx, dword ptr [ebp - 0x30]
            //   ff75c8               | push                dword ptr [ebp - 0x38]
            //   e8????????           |                     
            //   8b4dd8               | mov                 ecx, dword ptr [ebp - 0x28]
            //   83c920               | or                  ecx, 0x20

        $sequence_7 = { ff5004 c7460c20354f00 8b4df4 64890d00000000 59 5f 5e }
            // n = 7, score = 200
            //   ff5004               | call                dword ptr [eax + 4]
            //   c7460c20354f00       | mov                 dword ptr [esi + 0xc], 0x4f3520
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   59                   | pop                 ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_8 = { ff7510 83c010 50 e8???????? 84c0 0f842f010000 ff7514 }
            // n = 7, score = 200
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   83c010               | add                 eax, 0x10
            //   50                   | push                eax
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   0f842f010000         | je                  0x135
            //   ff7514               | push                dword ptr [ebp + 0x14]

        $sequence_9 = { eb00 8b4df4 64890d00000000 59 5f 5e }
            // n = 6, score = 200
            //   eb00                 | jmp                 2
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   59                   | pop                 ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

    condition:
        7 of them and filesize < 3178496
}