rule win_sappycache_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.sappycache."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f1f440000 33d2 488d8d20420000 41b800200000 }
            // n = 4, score = 200
            //   0f1f440000           | jne                 0xffffffb3
            //   33d2                 | dec                 eax
            //   488d8d20420000       | mov                 ecx, edi
            //   41b800200000         | nop                 dword ptr [eax]

        $sequence_1 = { 4c8d05bd6c0000 488bf9 488d155b4d0000 b914000000 e8???????? 488bf0 }
            // n = 6, score = 200
            //   4c8d05bd6c0000       | dec                 eax
            //   488bf9               | mov                 esi, eax
            //   488d155b4d0000       | inc                 ecx
            //   b914000000           | mov                 ecx, 4
            //   e8????????           |                     
            //   488bf0               | mov                 dword ptr [ebp + 0x20], 0xea60

        $sequence_2 = { 488bd9 488bc2 488d0d5d9a0000 48890b 488d5308 33c9 48890a }
            // n = 7, score = 200
            //   488bd9               | dec                 eax
            //   488bc2               | add                 ebx, 8
            //   488d0d5d9a0000       | dec                 eax
            //   48890b               | lea                 eax, [0xfb00]
            //   488d5308             | dec                 eax
            //   33c9                 | cmp                 ebx, eax
            //   48890a               | jne                 0xffffffe4

        $sequence_3 = { 4883ec20 448bf1 4c8d3dee79ffff 4d8be1 498be8 4c8bea 4b8b8cf7c0860100 }
            // n = 7, score = 200
            //   4883ec20             | dec                 esp
            //   448bf1               | lea                 ecx, [ebp - 0x50]
            //   4c8d3dee79ffff       | inc                 ebp
            //   4d8be1               | xor                 eax, eax
            //   498be8               | dec                 eax
            //   4c8bea               | lea                 ecx, [ebp + 0x240]
            //   4b8b8cf7c0860100     | dec                 eax

        $sequence_4 = { 482be0 488b05???????? 4833c4 48898424c0060400 488be9 33d2 }
            // n = 6, score = 200
            //   482be0               | jae                 0xa4
            //   488b05????????       |                     
            //   4833c4               | dec                 eax
            //   48898424c0060400     | mov                 edi, ebx
            //   488be9               | dec                 esp
            //   33d2                 | lea                 esi, [0xf9ea]

        $sequence_5 = { ff15???????? 488b4d88 ff15???????? 488d8540010000 498bd7 48ffc2 }
            // n = 6, score = 200
            //   ff15????????         |                     
            //   488b4d88             | test                eax, eax
            //   ff15????????         |                     
            //   488d8540010000       | je                  0x187
            //   498bd7               | dec                 esp
            //   48ffc2               | lea                 eax, [esp + 0x4b0]

        $sequence_6 = { b908000000 4c8d058b6a0000 488d158c6a0000 e8???????? 488bf8 4885c0 7428 }
            // n = 7, score = 200
            //   b908000000           | sar                 eax, 6
            //   4c8d058b6a0000       | dec                 eax
            //   488d158c6a0000       | shl                 ecx, 6
            //   e8????????           |                     
            //   488bf8               | dec                 ecx
            //   4885c0               | mov                 eax, dword ptr [eax + eax*8]
            //   7428                 | dec                 eax

        $sequence_7 = { 895128 488d0daf750000 488b45d8 488908 488d0d31070100 }
            // n = 5, score = 200
            //   895128               | mov                 edi, dword ptr [esp + 0x88]
            //   488d0daf750000       | dec                 eax
            //   488b45d8             | mov                 ecx, dword ptr [esp + 0x50]
            //   488908               | dec                 eax
            //   488d0d31070100       | xor                 ecx, esp

        $sequence_8 = { 83e03f 458bc8 2bc8 488d05d8380100 49d3c9 }
            // n = 5, score = 200
            //   83e03f               | mov                 dword ptr [esp + 0x6338], esi
            //   458bc8               | dec                 esp
            //   2bc8                 | lea                 esi, [0x12204]
            //   488d05d8380100       | dec                 ecx
            //   49d3c9               | mov                 edx, esi

        $sequence_9 = { c7452400010000 b940000000 4c896d30 ff15???????? 488d5524 }
            // n = 5, score = 200
            //   c7452400010000       | lea                 ecx, [0x9abd]
            //   b940000000           | dec                 eax
            //   4c896d30             | mov                 dword ptr [ebx], ecx
            //   ff15????????         |                     
            //   488d5524             | dec                 eax

    condition:
        7 of them and filesize < 262144
}