rule win_rising_sun_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.rising_sun."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83c704 4863ce 8b9c0510010000 4863c7 48c1e109 488d940510010000 448bc3 }
            // n = 7, score = 100
            //   83c704               | mov                 ecx, esi
            //   4863ce               | test                eax, eax
            //   8b9c0510010000       | je                  0x1807
            //   4863c7               | dec                 eax
            //   48c1e109             | mov                 ecx, dword ptr [ebx + 0x10]
            //   488d940510010000     | dec                 eax
            //   448bc3               | dec                 ecx

        $sequence_1 = { 488b4c2430 e8???????? 488b0d???????? 4885c9 7406 ff15???????? }
            // n = 6, score = 100
            //   488b4c2430           | mov                 dword ptr [ebp - 0x80], 0xc8c8c8c8
            //   e8????????           |                     
            //   488b0d????????       |                     
            //   4885c9               | mov                 dword ptr [ebp - 0x7c], 0xa9beaca9
            //   7406                 | mov                 dword ptr [esp + 0x74], 0x9d7828c0
            //   ff15????????         |                     

        $sequence_2 = { 4881ecd00b0000 488b05???????? 4833c4 488985c00a0000 33f6 488bd9 488d8d72010000 }
            // n = 7, score = 100
            //   4881ecd00b0000       | lea                 ebp, [esp - 0x1c10]
            //   488b05????????       |                     
            //   4833c4               | mov                 eax, 0x1d10
            //   488985c00a0000       | dec                 eax
            //   33f6                 | sub                 esp, eax
            //   488bd9               | movaps              xmmword ptr [esp + 0x1d00], xmm6
            //   488d8d72010000       | push                ebp

        $sequence_3 = { 85c0 0f84fc010000 0f1f440000 498bcd 0fb7440d8c 4883c102 6689840d5e060000 }
            // n = 7, score = 100
            //   85c0                 | xor                 eax, eax
            //   0f84fc010000         | cmp                 cl, 0xa
            //   0f1f440000           | sete                al
            //   498bcd               | mov                 dword ptr [esp + 0x4c], eax
            //   0fb7440d8c           | dec                 eax
            //   4883c102             | lea                 eax, [0x1766a]
            //   6689840d5e060000     | jne                 0x467

        $sequence_4 = { c7454c04349aa4 c745500d148684 c7455418f4cb64 c7455802d4f444 c7455c88b43a24 c7456097940f04 c74564ea7469e4 }
            // n = 7, score = 100
            //   c7454c04349aa4       | lea                 eax, [ecx + 1]
            //   c745500d148684       | xor                 edx, edx
            //   c7455418f4cb64       | dec                 eax
            //   c7455802d4f444       | mov                 dword ptr [esp + 0x20], eax
            //   c7455c88b43a24       | inc                 ebp
            //   c7456097940f04       | xor                 ecx, ecx
            //   c74564ea7469e4       | dec                 esp

        $sequence_5 = { 4533c0 33d2 498bce ff15???????? 85c0 7552 }
            // n = 6, score = 100
            //   4533c0               | mov                 ecx, ebx
            //   33d2                 | dec                 esp
            //   498bce               | arpl                ax, bx
            //   ff15????????         |                     
            //   85c0                 | jns                 0x45b
            //   7552                 | or                  eax, 0xffffffff

        $sequence_6 = { ff15???????? 8d530f 85c0 755c 488dbdc01b0000 4c8bc2 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   8d530f               | dec                 eax
            //   85c0                 | lea                 edx, [0x14a8c]
            //   755c                 | dec                 eax
            //   488dbdc01b0000       | lea                 ecx, [ebp + 0x2230]
            //   4c8bc2               | inc                 ebp

        $sequence_7 = { 66f3a7 75bf 488d4c2430 e8???????? 488d4c2430 }
            // n = 5, score = 100
            //   66f3a7               | add                 dword ptr [esi], 4
            //   75bf                 | cmp                 edi, 0x13
            //   488d4c2430           | je                  0x416
            //   e8????????           |                     
            //   488d4c2430           | cmp                 edi, 0xa

        $sequence_8 = { 4883ec20 33c0 48c7411807000000 488d15a97d0200 48894110 4983c9ff 4533c0 }
            // n = 7, score = 100
            //   4883ec20             | je                  0x3f0
            //   33c0                 | dec                 eax
            //   48c7411807000000     | inc                 ebx
            //   488d15a97d0200       | dec                 eax
            //   48894110             | cmp                 ebx, ebp
            //   4983c9ff             | jae                 0x3f8
            //   4533c0               | inc                 cx

        $sequence_9 = { 4803c0 83ff0a 48896cc108 0f446c2470 8bc5 eb02 }
            // n = 6, score = 100
            //   4803c0               | dec                 eax
            //   83ff0a               | mov                 ecx, esi
            //   48896cc108           | dec                 ecx
            //   0f446c2470           | mov                 ecx, esp
            //   8bc5                 | cmp                 eax, 0x3d
            //   eb02                 | jne                 0x4cc

    condition:
        7 of them and filesize < 409600
}