rule win_retro_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.retro."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83c8ff 4883c428 c3 807c2438ff 75f1 0fb6442439 24e0 }
            // n = 7, score = 200
            //   83c8ff               | comiss              xmm6, xmmword ptr [edi + ecx]
            //   4883c428             | jbe                 0xc5
            //   c3                   | xor                 eax, eax
            //   807c2438ff           | jmp                 0xca
            //   75f1                 | mov                 eax, 1
            //   0fb6442439           | mov                 dword ptr [ecx - 4], edx
            //   24e0                 | mov                 dword ptr [ecx], eax

        $sequence_1 = { 666666660f1f840000000000 f20f10d8 f20f10d0 f20f59d0 4423c0 0f849b000000 f20f101df331fcff }
            // n = 7, score = 200
            //   666666660f1f840000000000     | subps    xmm5, xmm0
            //   f20f10d8             | movaps              xmm0, xmm3
            //   f20f10d0             | inc                 ecx
            //   f20f59d0             | mulps               xmm0, xmmword ptr [ecx + 0x20]
            //   4423c0               | addss               xmm0, dword ptr [edx + 0x20]
            //   0f849b000000         | movss               dword ptr [eax + 0x400], xmm0
            //   f20f101df331fcff     | inc                 ecx

        $sequence_2 = { 89bb84000000 33c0 488b5c2430 4883c420 5f c3 83c8ff }
            // n = 7, score = 200
            //   89bb84000000         | dec                 eax
            //   33c0                 | add                 ecx, 8
            //   488b5c2430           | dec                 eax
            //   4883c420             | add                 eax, 0x2920
            //   5f                   | inc                 ecx
            //   c3                   | inc                 ebp
            //   83c8ff               | dec                 eax

        $sequence_3 = { f2410f594018 f20f5ac0 f30f1101 f30f114140 448d4a02 418bc1 83e01f }
            // n = 7, score = 200
            //   f2410f594018         | inc                 esp
            //   f20f5ac0             | movaps              xmm0, xmm0
            //   f30f1101             | addss               xmm5, xmm4
            //   f30f114140           | inc                 esp
            //   448d4a02             | addps               xmm0, xmm7
            //   418bc1               | subss               xmm7, xmm0
            //   83e01f               | inc                 ebp

        $sequence_4 = { 4d2be6 4b8db437c8170000 4c8d7588 4d2bf7 4c2b742430 0f1f8000000000 8b4608 }
            // n = 7, score = 200
            //   4d2be6               | movss               xmm4, dword ptr [edi - 0x1c]
            //   4b8db437c8170000     | movss               dword ptr [ebp + 0x18], xmm2
            //   4c8d7588             | movaps              xmm2, xmm4
            //   4d2bf7               | subss               xmm3, xmm4
            //   4c2b742430           | subss               xmm2, xmm0
            //   0f1f8000000000       | movss               dword ptr [edi - 0x44], xmm3
            //   8b4608               | movss               xmm4, dword ptr [edi - 0x24]

        $sequence_5 = { 4c8b6c2468 4c8d442450 498bd4 4d8bcd 488bcb }
            // n = 5, score = 200
            //   4c8b6c2468           | mov                 ebx, ecx
            //   4c8d442450           | inc                 esp
            //   498bd4               | mov                 dword ptr [esp + 0x30], ebp
            //   4d8bcd               | inc                 esp
            //   488bcb               | mov                 dword ptr [esp + 0x60], esi

        $sequence_6 = { 66410f6ecb f30f114114 f30fe6c9 660f6e4118 660f28d1 0f5ac0 f20f59d3 }
            // n = 7, score = 200
            //   66410f6ecb           | inc                 ecx
            //   f30f114114           | mulps               xmm0, xmm2
            //   f30fe6c9             | inc                 ecx
            //   660f6e4118           | mulps               xmm6, xmm4
            //   660f28d1             | inc                 ecx
            //   0f5ac0               | mulps               xmm0, xmm3
            //   f20f59d3             | addss               xmm5, xmm6

        $sequence_7 = { 837b3801 488b5328 7431 488b4b30 4885c9 7469 66666666660f1f840000000000 }
            // n = 7, score = 200
            //   837b3801             | dec                 eax
            //   488b5328             | je                  0x587
            //   7431                 | inc                 ecx
            //   488b4b30             | dec                 eax
            //   4885c9               | jne                 0x59f
            //   7469                 | movaps              xmmword ptr [esp], xmm4
            //   66666666660f1f840000000000     | dec    ecx

        $sequence_8 = { 7e25 488d8b00050000 6690 8b83ac080000 ffc8 3901 7e02 }
            // n = 7, score = 200
            //   7e25                 | inc                 esp
            //   488d8b00050000       | movaps              xmm0, xmmword ptr [esp + 0x20]
            //   6690                 | inc                 ecx
            //   8b83ac080000         | addps               xmm0, xmmword ptr [eax + 8]
            //   ffc8                 | inc                 ecx
            //   3901                 | movups              xmmword ptr [eax + 8], xmm0
            //   7e02                 | movaps              xmm0, xmm4

        $sequence_9 = { ff15???????? 448bc0 488d15f7280400 488d0d30290400 e8???????? e9???????? 837c245405 }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   448bc0               | movaps              xmmword ptr [esp + 0x20], xmm6
            //   488d15f7280400       | dec                 eax
            //   488d0d30290400       | mov                 ebx, ecx
            //   e8????????           |                     
            //   e9????????           |                     
            //   837c245405           | movaps              xmm6, xmm1

    condition:
        7 of them and filesize < 1409024
}