rule win_sappycache_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 418b4650 488d6aff 4803e8 488d4aff 4803cf }
            // n = 5, score = 200
            //   418b4650             | dec                 eax
            //   488d6aff             | lea                 ebp, [esp - 0x6248]
            //   4803e8               | push                esi
            //   488d4aff             | inc                 ecx
            //   4803cf               | push                ebp

        $sequence_1 = { b940000000 8bd8 ff15???????? 448bc3 488bd6 488bc8 }
            // n = 6, score = 200
            //   b940000000           | lea                 eax, [ecx + 4]
            //   8bd8                 | dec                 esp
            //   ff15????????         |                     
            //   448bc3               | mov                 eax, dword ptr [esp + 0x38]
            //   488bd6               | dec                 eax
            //   488bc8               | mov                 ecx, dword ptr [esp + 0x38]

        $sequence_2 = { 488d0c28 4923c5 4923cd 483bc1 }
            // n = 4, score = 200
            //   488d0c28             | cmp                 ecx, eax
            //   4923c5               | dec                 eax
            //   4923cd               | test                ecx, ecx
            //   483bc1               | je                  0x40

        $sequence_3 = { 488d2d98d60000 488d4d30 4533c0 baa00f0000 e8???????? 488b05???????? }
            // n = 6, score = 200
            //   488d2d98d60000       | inc                 ecx
            //   488d4d30             | setne               ch
            //   4533c0               | inc                 ecx
            //   baa00f0000           | mov                 eax, ebp
            //   e8????????           |                     
            //   488b05????????       |                     

        $sequence_4 = { 493bf6 0f8593000000 440fb6442458 0fb65c2459 410fb6d0 0fb67c245a 0fb6c3 }
            // n = 7, score = 200
            //   493bf6               | mov                 dword ptr [ebp + 0x20], 0xea60
            //   0f8593000000         | dec                 esp
            //   440fb6442458         | lea                 eax, [ebp + 0x20]
            //   0fb65c2459           | dec                 eax
            //   410fb6d0             | mov                 ecx, ebx
            //   0fb67c245a           | inc                 ecx
            //   0fb6c3               | lea                 edx, [ecx - 2]

        $sequence_5 = { 488b0b ff15???????? 85c0 7428 488bcd 488d1545f80000 83e13f }
            // n = 7, score = 200
            //   488b0b               | dec                 eax
            //   ff15????????         |                     
            //   85c0                 | mov                 edx, ebx
            //   7428                 | xor                 ecx, ecx
            //   488bcd               | dec                 esp
            //   488d1545f80000       | lea                 esp, [0xf1ef]
            //   83e13f               | mov                 ebp, esi

        $sequence_6 = { 83fa48 7243 8b4b40 8b4344 894c2450 83c140 }
            // n = 6, score = 200
            //   83fa48               | dec                 eax
            //   7243                 | cmp                 eax, ecx
            //   8b4b40               | dec                 eax
            //   8b4344               | test                eax, eax
            //   894c2450             | je                  0x753
            //   83c140               | dec                 eax

        $sequence_7 = { 4c8d44246c ba00000200 488d8c24c0060000 e8???????? 4c8d0567240100 ba00000200 }
            // n = 6, score = 200
            //   4c8d44246c           | lea                 eax, [ebp + 0x60]
            //   ba00000200           | xor                 edx, edx
            //   488d8c24c0060000     | dec                 eax
            //   e8????????           |                     
            //   4c8d0567240100       | lea                 ecx, [ebp + 0x3a20]
            //   ba00000200           | inc                 ecx

        $sequence_8 = { ff15???????? 85c0 0f84d6000000 0f1f440000 }
            // n = 4, score = 200
            //   ff15????????         |                     
            //   85c0                 | dec                 esp
            //   0f84d6000000         | mov                 dword ptr [esp + 0x30], esi
            //   0f1f440000           | inc                 esp

        $sequence_9 = { 660f1f440000 48ffc2 6644392c50 75f6 4c8d4db0 4533c0 }
            // n = 6, score = 200
            //   660f1f440000         | sar                 eax, 6
            //   48ffc2               | dec                 esp
            //   6644392c50           | lea                 eax, [0xe120]
            //   75f6                 | and                 edx, 0x3f
            //   4c8d4db0             | dec                 eax
            //   4533c0               | arpl                word ptr [eax], cx

    condition:
        7 of them and filesize < 262144
}