rule win_sdbbot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-08-17"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
        malpedia_rule_date = "20200817"
        malpedia_hash = "8c895fd01eccb47a6225bcb1a3ba53cbb98644c5"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c3 803d????????00 750c c605????????01 }
            // n = 4, score = 400
            //   c3                   | ret                 
            //   803d????????00       |                     
            //   750c                 | jne                 0xe
            //   c605????????01       |                     

        $sequence_1 = { 8b45f8 8b75fc 83c728 85db 75d2 8b5df0 }
            // n = 6, score = 400
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   8b75fc               | mov                 esi, dword ptr [ebp - 4]
            //   83c728               | add                 edi, 0x28
            //   85db                 | test                ebx, ebx
            //   75d2                 | jne                 0xffffffd4
            //   8b5df0               | mov                 ebx, dword ptr [ebp - 0x10]

        $sequence_2 = { 83c1e0 81c2ffff0000 03cf 46 6685d2 75e4 }
            // n = 6, score = 400
            //   83c1e0               | add                 ecx, -0x20
            //   81c2ffff0000         | add                 edx, 0xffff
            //   03cf                 | add                 ecx, edi
            //   46                   | inc                 esi
            //   6685d2               | test                dx, dx
            //   75e4                 | jne                 0xffffffe6

        $sequence_3 = { 8b5dfc 03f3 6a00 6a00 6aff ff55e0 ff7508 }
            // n = 7, score = 400
            //   8b5dfc               | mov                 ebx, dword ptr [ebp - 4]
            //   03f3                 | add                 esi, ebx
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6aff                 | push                -1
            //   ff55e0               | call                dword ptr [ebp - 0x20]
            //   ff7508               | push                dword ptr [ebp + 8]

        $sequence_4 = { 0fb63e c1c90d 803e61 7203 83c1e0 }
            // n = 5, score = 400
            //   0fb63e               | movzx               edi, byte ptr [esi]
            //   c1c90d               | ror                 ecx, 0xd
            //   803e61               | cmp                 byte ptr [esi], 0x61
            //   7203                 | jb                  5
            //   83c1e0               | add                 ecx, -0x20

        $sequence_5 = { 7555 8b4df0 0fb711 8b4ddc 8b491c 8d0c91 03ce }
            // n = 7, score = 400
            //   7555                 | jne                 0x57
            //   8b4df0               | mov                 ecx, dword ptr [ebp - 0x10]
            //   0fb711               | movzx               edx, word ptr [ecx]
            //   8b4ddc               | mov                 ecx, dword ptr [ebp - 0x24]
            //   8b491c               | mov                 ecx, dword ptr [ecx + 0x1c]
            //   8d0c91               | lea                 ecx, [ecx + edx*4]
            //   03ce                 | add                 ecx, esi

        $sequence_6 = { 833f00 0f847d000000 8b470c 03c6 }
            // n = 4, score = 400
            //   833f00               | cmp                 dword ptr [edi], 0
            //   0f847d000000         | je                  0x83
            //   8b470c               | mov                 eax, dword ptr [edi + 0xc]
            //   03c6                 | add                 eax, esi

        $sequence_7 = { 85db 759d 8b45e4 8b55ec 8b4804 eb03 8b45e4 }
            // n = 7, score = 400
            //   85db                 | test                ebx, ebx
            //   759d                 | jne                 0xffffff9f
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]
            //   8b4804               | mov                 ecx, dword ptr [eax + 4]
            //   eb03                 | jmp                 5
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]

        $sequence_8 = { 8b7820 8b7024 03fb 03f3 8b17 }
            // n = 5, score = 400
            //   8b7820               | mov                 edi, dword ptr [eax + 0x20]
            //   8b7024               | mov                 esi, dword ptr [eax + 0x24]
            //   03fb                 | add                 edi, ebx
            //   03f3                 | add                 esi, ebx
            //   8b17                 | mov                 edx, dword ptr [edi]

        $sequence_9 = { 7608 8d4870 80f91f 7702 }
            // n = 4, score = 200
            //   7608                 | jbe                 0xa
            //   8d4870               | lea                 ecx, [eax + 0x70]
            //   80f91f               | cmp                 cl, 0x1f
            //   7702                 | ja                  4

        $sequence_10 = { 81ea21100000 8bca c1f90e 80c9c0 }
            // n = 4, score = 200
            //   81ea21100000         | sub                 edx, 0x1021
            //   8bca                 | mov                 ecx, edx
            //   c1f90e               | sar                 ecx, 0xe
            //   80c9c0               | or                  cl, 0xc0

        $sequence_11 = { 83e821 8bc8 c0e002 c1f906 }
            // n = 4, score = 200
            //   83e821               | sub                 eax, 0x21
            //   8bc8                 | mov                 ecx, eax
            //   c0e002               | shl                 al, 2
            //   c1f906               | sar                 ecx, 6

        $sequence_12 = { 83f8ff 750d ff15???????? 3d48270000 }
            // n = 4, score = 200
            //   83f8ff               | cmp                 eax, -1
            //   750d                 | jne                 0xf
            //   ff15????????         |                     
            //   3d48270000           | cmp                 eax, 0x2748

        $sequence_13 = { 488b5308 488d442450 4889442448 4533c9 }
            // n = 4, score = 100
            //   488b5308             | dec                 eax
            //   488d442450           | mov                 edx, dword ptr [ebx + 8]
            //   4889442448           | dec                 eax
            //   4533c9               | lea                 eax, [esp + 0x50]

        $sequence_14 = { e8???????? 488b4567 4885c0 7404 33ff eb32 488d0d80480000 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488b4567             | xor                 ecx, ecx
            //   4885c0               | test                al, al
            //   7404                 | je                  0x5f
            //   33ff                 | dec                 eax
            //   eb32                 | lea                 ecx, [0x7e29]
            //   488d0d80480000       | dec                 eax

        $sequence_15 = { e8???????? e8???????? 84c0 745d 803d????????00 488d0d297e0000 448b0d???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   e8????????           |                     
            //   84c0                 | dec                 eax
            //   745d                 | mov                 dword ptr [esp + 0x48], eax
            //   803d????????00       |                     
            //   488d0d297e0000       | inc                 ebp
            //   448b0d????????       |                     

    condition:
        7 of them and filesize < 1015808
}