rule win_rorschach_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.rorschach."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rorschach"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8885670e0000 33d2 488d8d300b0000 e8???????? 8885680e0000 b273 488d8d300b0000 }
            // n = 7, score = 100
            //   8885670e0000         | mov                 edx, 0x40
            //   33d2                 | dec                 eax
            //   488d8d300b0000       | lea                 ecx, [ebp + 0x381]
            //   e8????????           |                     
            //   8885680e0000         | mov                 byte ptr [eax], 0
            //   b273                 | dec                 ecx
            //   488d8d300b0000       | inc                 edi

        $sequence_1 = { f65d7f 488d15ece30000 4c8d05e9e30000 488955df 488d05d2e30000 488955e7 488945bf }
            // n = 7, score = 100
            //   f65d7f               | dec                 eax
            //   488d15ece30000       | lea                 ecx, [ebp + 0x3d0]
            //   4c8d05e9e30000       | mov                 dl, 0x6b
            //   488955df             | dec                 eax
            //   488d05d2e30000       | lea                 ecx, [ebp + 0x6d0]
            //   488955e7             | mov                 byte ptr [ebp + 0x83b], al
            //   488945bf             | xor                 edx, edx

        $sequence_2 = { 884511 33d2 488d4d10 e8???????? 884512 b265 488d4d10 }
            // n = 7, score = 100
            //   884511               | mov                 edx, dword ptr [esp + 0x48]
            //   33d2                 | dec                 eax
            //   488d4d10             | cmp                 edx, 8
            //   e8????????           |                     
            //   884512               | jb                  0x145b
            //   b265                 | dec                 eax
            //   488d4d10             | lea                 edx, [edx*2 + 2]

        $sequence_3 = { f30f7f4c1930 4883c140 4881f900020000 72ad 4881f91d020000 7314 0f1f4000 }
            // n = 7, score = 100
            //   f30f7f4c1930         | mov                 dl, 0x66
            //   4883c140             | dec                 eax
            //   4881f900020000       | lea                 ecx, [ebp + 0xa0]
            //   72ad                 | mov                 byte ptr [ebp + 0xa9], al
            //   4881f91d020000       | xor                 edx, edx
            //   7314                 | dec                 eax
            //   0f1f4000             | lea                 ecx, [ebp + 0xa0]

        $sequence_4 = { 4889542440 488bda ff15???????? 33d2 488d4c2450 41b808020000 e8???????? }
            // n = 7, score = 100
            //   4889542440           | dec                 eax
            //   488bda               | lea                 ecx, [ebp + 0xb30]
            //   ff15????????         |                     
            //   33d2                 | mov                 byte ptr [ebp + 0xbb4], al
            //   488d4c2450           | mov                 dl, 0x72
            //   41b808020000         | dec                 eax
            //   e8????????           |                     

        $sequence_5 = { 488d8dd0030000 e8???????? 888507040000 33d2 488d8dd0030000 e8???????? 888508040000 }
            // n = 7, score = 100
            //   488d8dd0030000       | dec                 eax
            //   e8????????           |                     
            //   888507040000         | cmp                 eax, 0x1f
            //   33d2                 | ja                  0x1337
            //   488d8dd0030000       | xor                 esi, esi
            //   e8????????           |                     
            //   888508040000         | dec                 eax

        $sequence_6 = { b23c 488d8de0080000 e8???????? 8885750a0000 33d2 488d8de0080000 e8???????? }
            // n = 7, score = 100
            //   b23c                 | mov                 byte ptr [esp + 0x2e], al
            //   488d8de0080000       | mov                 dl, 0x6c
            //   e8????????           |                     
            //   8885750a0000         | dec                 eax
            //   33d2                 | lea                 ecx, [esp + 0x28]
            //   488d8de0080000       | mov                 byte ptr [esp + 0x2e], al
            //   e8????????           |                     

        $sequence_7 = { 8885f10c0000 33d2 488d8d300b0000 e8???????? 8885f20c0000 b26d 488d8d300b0000 }
            // n = 7, score = 100
            //   8885f10c0000         | dec                 ecx
            //   33d2                 | mov                 esi, 0xffffffff
            //   488d8d300b0000       | dec                 ebp
            //   e8????????           |                     
            //   8885f20c0000         | mov                 eax, esi
            //   b26d                 | dec                 ecx
            //   488d8d300b0000       | inc                 eax

        $sequence_8 = { e9???????? 0f57db f2480f2adb 4885db 7908 f20f581d???????? 4881fb00001000 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   0f57db               | lea                 ecx, [ebp + 0x6d0]
            //   f2480f2adb           | mov                 byte ptr [ebp + 0x7a1], al
            //   4885db               | xor                 edx, edx
            //   7908                 | dec                 eax
            //   f20f581d????????     |                     
            //   4881fb00001000       | lea                 ecx, [ebp + 0x6d0]

        $sequence_9 = { f7d7 488b742438 4423f7 8b7c2404 23f3 237c2408 4433fe }
            // n = 7, score = 100
            //   f7d7                 | lea                 ecx, [ebp + 0x8e0]
            //   488b742438           | mov                 dl, 0x6c
            //   4423f7               | dec                 eax
            //   8b7c2404             | lea                 ecx, [ebp + 0x8e0]
            //   23f3                 | mov                 byte ptr [ebp + 0xa85], al
            //   237c2408             | xor                 edx, edx
            //   4433fe               | dec                 eax

    condition:
        7 of them and filesize < 3921930
}