rule win_rdat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.rdat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rdat"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f8ce5feffff 85ed 0f8ee6000000 33f6 4863ed }
            // n = 5, score = 300
            //   0f8ce5feffff         | inc                 esp
            //   85ed                 | mov                 edx, dword ptr [edx]
            //   0f8ee6000000         | dec                 esp
            //   33f6                 | lea                 ecx, [ecx + 0x20]
            //   4863ed               | inc                 ecx

        $sequence_1 = { 48897818 4c897020 4157 4883ec20 448b12 }
            // n = 5, score = 300
            //   48897818             | dec                 esp
            //   4c897020             | mov                 dword ptr [eax + 0x20], esi
            //   4157                 | inc                 eax
            //   4883ec20             | xor                 ch, ch
            //   448b12               | inc                 ebp

        $sequence_2 = { 85c0 740b b9e8030000 ff15???????? }
            // n = 4, score = 300
            //   85c0                 | dec                 eax
            //   740b                 | test                eax, eax
            //   b9e8030000           | jne                 0x2c
            //   ff15????????         |                     

        $sequence_3 = { 38442420 752b 4983fe0f 7d0c ffc5 428974b430 }
            // n = 6, score = 300
            //   38442420             | cmp                 byte ptr [esp + 0x20], al
            //   752b                 | jne                 0x2d
            //   4983fe0f             | dec                 ecx
            //   7d0c                 | cmp                 esi, 0xf
            //   ffc5                 | jge                 0xe
            //   428974b430           | inc                 ebp

        $sequence_4 = { 4883791810 488b7910 7203 488b09 483bfb }
            // n = 5, score = 300
            //   4883791810           | inc                 ecx
            //   488b7910             | lea                 eax, [eax + 2]
            //   7203                 | dec                 eax
            //   488b09               | mov                 dword ptr [eax + 0x20], edi
            //   483bfb               | inc                 ecx

        $sequence_5 = { 4883ec48 4533c0 41b902001f00 84c9 }
            // n = 4, score = 300
            //   4883ec48             | mov                 dword ptr [eax + 0x18], edi
            //   4533c0               | dec                 esp
            //   41b902001f00         | mov                 dword ptr [eax + 0x20], esi
            //   84c9                 | inc                 ecx

        $sequence_6 = { 4883ec40 f702ffffff0f 4c8d4920 488bfa }
            // n = 4, score = 300
            //   4883ec40             | inc                 ebp
            //   f702ffffff0f         | inc                 edx
            //   4c8d4920             | mov                 dword ptr [esp + esi*4 + 0x30], esi
            //   488bfa               | dec                 ecx

        $sequence_7 = { 48897820 4156 4883ec20 33db 408aea 488bf9 408af3 }
            // n = 7, score = 300
            //   48897820             | dec                 eax
            //   4156                 | mov                 dword ptr [eax + 0x18], edi
            //   4883ec20             | dec                 esp
            //   33db                 | mov                 dword ptr [eax + 0x20], esi
            //   408aea               | inc                 ecx
            //   488bf9               | push                edi
            //   408af3               | dec                 eax

        $sequence_8 = { 483bfb 4c8bc3 4c0f42c7 4d85c0 7504 8bc6 eb05 }
            // n = 7, score = 300
            //   483bfb               | inc                 ecx
            //   4c8bc3               | lea                 eax, [eax + 2]
            //   4c0f42c7             | inc                 esp
            //   4d85c0               | cmovne              eax, eax
            //   7504                 | xor                 edx, edx
            //   8bc6                 | jl                  0xfffffeeb
            //   eb05                 | test                ebp, ebp

        $sequence_9 = { 48897818 4c897020 4032ed 4533c9 }
            // n = 4, score = 300
            //   48897818             | lea                 ecx, [ecx + 0x20]
            //   4c897020             | dec                 eax
            //   4032ed               | mov                 edi, edx
            //   4533c9               | dec                 eax

        $sequence_10 = { 4038341a 75f7 4883791810 488b7910 }
            // n = 4, score = 300
            //   4038341a             | sub                 esp, 0x48
            //   75f7                 | inc                 ebp
            //   4883791810           | xor                 eax, eax
            //   488b7910             | inc                 ecx

        $sequence_11 = { 0f84c7000000 418b80c0000000 4533c9 85c0 0f8eb5000000 418b88a4000000 418bd1 }
            // n = 7, score = 300
            //   0f84c7000000         | test                dword ptr [edx], 0xfffffff
            //   418b80c0000000       | dec                 esp
            //   4533c9               | lea                 ecx, [ecx + 0x20]
            //   85c0                 | dec                 eax
            //   0f8eb5000000         | mov                 edi, edx
            //   418b88a4000000       | dec                 ecx
            //   418bd1               | mov                 esi, eax

        $sequence_12 = { 4885c0 751e 483bfb 7313 83c8ff }
            // n = 5, score = 300
            //   4885c0               | mov                 ecx, 0x1f0002
            //   751e                 | test                cl, cl
            //   483bfb               | dec                 eax
            //   7313                 | sub                 esp, 0x48
            //   83c8ff               | inc                 ebp

        $sequence_13 = { c3 48833d????????00 488d058d330100 740f }
            // n = 4, score = 100
            //   c3                   | dec                 eax
            //   48833d????????00     |                     
            //   488d058d330100       | cmp                 dword ptr [ecx + 0x18], 0x10
            //   740f                 | dec                 eax

        $sequence_14 = { 488bcf e8???????? 488bc7 488b8c2480000000 4833cc e8???????? 488b9c24a8000000 }
            // n = 7, score = 100
            //   488bcf               | dec                 eax
            //   e8????????           |                     
            //   488bc7               | mov                 edi, dword ptr [ecx + 0x10]
            //   488b8c2480000000     | jb                  5
            //   4833cc               | dec                 eax
            //   e8????????           |                     
            //   488b9c24a8000000     | mov                 ecx, dword ptr [ecx]

        $sequence_15 = { 4883bc244803000010 480f43942430030000 488d8424b8070000 48898424b0070000 41b803000000 }
            // n = 5, score = 100
            //   4883bc244803000010     | mov    edi, dword ptr [ecx + 0x10]
            //   480f43942430030000     | jb    9
            //   488d8424b8070000     | dec                 eax
            //   48898424b0070000     | mov                 ecx, dword ptr [ecx]
            //   41b803000000         | dec                 eax

    condition:
        7 of them and filesize < 1573888
}