rule win_retro_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.retro."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { f20f59c2 f20f5c2dd713fcff f20f59da f20f580d9b14fcff f20f58056314fcff f20f582dbb13fcff f20f59da }
            // n = 7, score = 200
            //   f20f59c2             | mov                 ecx, dword ptr [ebx + 0x18]
            //   f20f5c2dd713fcff     | dec                 eax
            //   f20f59da             | test                ecx, ecx
            //   f20f580d9b14fcff     | je                  0x101b
            //   f20f58056314fcff     | inc                 ecx
            //   f20f582dbb13fcff     | mov                 byte ptr [edx - 7], al
            //   f20f59da             | inc                 cx

        $sequence_1 = { 488b442440 eb02 33c0 488b8c2470010000 4833cc e8???????? 4881c480010000 }
            // n = 7, score = 200
            //   488b442440           | lea                 esi, [ebp - 0x28]
            //   eb02                 | dec                 eax
            //   33c0                 | lea                 edi, [0x45e8e]
            //   488b8c2470010000     | mov                 ecx, 4
            //   4833cc               | repe cmpsb          byte ptr [esi], byte ptr es:[edi]
            //   e8????????           |                     
            //   4881c480010000       | jne                 0x4aa

        $sequence_2 = { 0f284c2470 0f11443340 0f114c3350 89443360 83c364 83bfa000000000 740b }
            // n = 7, score = 200
            //   0f284c2470           | jne                 0x424
            //   0f11443340           | dec                 esp
            //   0f114c3350           | mov                 edx, dword ptr [esp + 0x40]
            //   89443360             | inc                 ecx
            //   83c364               | movzx               eax, cl
            //   83bfa000000000       | dec                 ecx
            //   740b                 | mov                 edi, eax

        $sequence_3 = { f30f1025???????? 0f28ec f30f59e6 f3410f59ee f30f5829 f30f58642408 }
            // n = 6, score = 200
            //   f30f1025????????     |                     
            //   0f28ec               | mov                 ecx, dword ptr [esp + 0x998]
            //   f30f59e6             | dec                 eax
            //   f3410f59ee           | add                 ecx, eax
            //   f30f5829             | dec                 eax
            //   f30f58642408         | mov                 eax, ecx

        $sequence_4 = { 41f7e4 d1ea 410f2ff0 f30f5844947c f30f1144947c 7626 450f2fc2 }
            // n = 7, score = 200
            //   41f7e4               | mov                 dword ptr [eax], ebx
            //   d1ea                 | mov                 eax, 5
            //   410f2ff0             | jmp                 0x2f0
            //   f30f5844947c         | inc                 esp
            //   f30f1144947c         | mov                 dword ptr [eax], ebx
            //   7626                 | xor                 eax, eax
            //   450f2fc2             | jns                 0x2fb

        $sequence_5 = { 75ba e9???????? 48636c2458 4533c9 4883f904 0f8c36010000 488d79fc }
            // n = 7, score = 200
            //   75ba                 | movaps              xmm7, xmm0
            //   e9????????           |                     
            //   48636c2458           | inc                 edx
            //   4533c9               | mov                 ecx, dword ptr [ebx + ebp + 0x6fc]
            //   4883f904             | inc                 edx
            //   0f8c36010000         | mov                 eax, dword ptr [ebx + ebp + 0x6f8]
            //   488d79fc             | inc                 edx

        $sequence_6 = { 4c8d1d96660000 f30fe6cc f20f1015???????? f20f59d1 660f7ee1 48c7c03f000000 23c1 }
            // n = 7, score = 200
            //   4c8d1d96660000       | movss               xmm0, dword ptr [ebx + 0xa5d0]
            //   f30fe6cc             | addss               xmm0, dword ptr [ebx + 0xa598]
            //   f20f1015????????     |                     
            //   f20f59d1             | addss               xmm1, dword ptr [ebx + 0xa59c]
            //   660f7ee1             | subss               xmm2, xmm0
            //   48c7c03f000000       | movss               xmm0, dword ptr [ebx + 0xa5c8]
            //   23c1                 | addss               xmm0, dword ptr [ebx + 0xa5a0]

        $sequence_7 = { 0f28c3 f30f1049fc f30f58d0 f30f59c9 0f2fd9 f30f58e1 7703 }
            // n = 7, score = 200
            //   0f28c3               | dec                 eax
            //   f30f1049fc           | lea                 edx, [esp + ecx*4 + 0x2c]
            //   f30f58d0             | dec                 ecx
            //   f30f59c9             | mov                 ecx, edx
            //   0f2fd9               | dec                 ecx
            //   f30f58e1             | sub                 ecx, ebx
            //   7703                 | dec                 eax

        $sequence_8 = { 410bc8 410bc0 81c9c0000000 0fbae807 894af8 8942f4 4183f905 }
            // n = 7, score = 200
            //   410bc8               | movd                mm3, dword ptr [eax]
            //   410bc0               | dec                 eax
            //   81c9c0000000         | add                 edx, eax
            //   0fbae807             | dec                 esp
            //   894af8               | add                 eax, eax
            //   8942f4               | cvtdq2ps            xmm3, xmm3
            //   4183f905             | cvtdq2ps            xmm2, xmm2

        $sequence_9 = { 48ffcb 75ee 488b9c2430010000 85f6 7e24 8bd6 }
            // n = 6, score = 200
            //   48ffcb               | mov                 ecx, dword ptr [esp + 0x88]
            //   75ee                 | inc                 ebp
            //   488b9c2430010000     | cmp                 esi, ebp
            //   85f6                 | jg                  0x270
            //   7e24                 | dec                 eax
            //   8bd6                 | lea                 ebp, [ebx + 0x129c]

    condition:
        7 of them and filesize < 1409024
}