rule win_sendsafe_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.sendsafe."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sendsafe"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b8dc013ffff 83c101 898dc013ffff c785dc13ffff09000000 6a00 8b95e013ffff 52 }
            // n = 7, score = 200
            //   8b8dc013ffff         | mov                 ecx, dword ptr [ebp - 0xec40]
            //   83c101               | add                 ecx, 1
            //   898dc013ffff         | mov                 dword ptr [ebp - 0xec40], ecx
            //   c785dc13ffff09000000     | mov    dword ptr [ebp - 0xec24], 9
            //   6a00                 | push                0
            //   8b95e013ffff         | mov                 edx, dword ptr [ebp - 0xec20]
            //   52                   | push                edx

        $sequence_1 = { e8???????? 83c40c 85c0 7e21 56 8d84249c010000 50 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   85c0                 | test                eax, eax
            //   7e21                 | jle                 0x23
            //   56                   | push                esi
            //   8d84249c010000       | lea                 eax, dword ptr [esp + 0x19c]
            //   50                   | push                eax

        $sequence_2 = { e8???????? 83c408 85c0 742e 6aff 6a00 8b4d18 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax
            //   742e                 | je                  0x30
            //   6aff                 | push                -1
            //   6a00                 | push                0
            //   8b4d18               | mov                 ecx, dword ptr [ebp + 0x18]

        $sequence_3 = { 8b95d4f7ffff 0fb6424d 85c0 7422 8b8dd4f7ffff 83794400 7416 }
            // n = 7, score = 200
            //   8b95d4f7ffff         | mov                 edx, dword ptr [ebp - 0x82c]
            //   0fb6424d             | movzx               eax, byte ptr [edx + 0x4d]
            //   85c0                 | test                eax, eax
            //   7422                 | je                  0x24
            //   8b8dd4f7ffff         | mov                 ecx, dword ptr [ebp - 0x82c]
            //   83794400             | cmp                 dword ptr [ecx + 0x44], 0
            //   7416                 | je                  0x18

        $sequence_4 = { eb07 c745fccd000000 8b4d08 8b55fc 895114 b001 8be5 }
            // n = 7, score = 200
            //   eb07                 | jmp                 9
            //   c745fccd000000       | mov                 dword ptr [ebp - 4], 0xcd
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   895114               | mov                 dword ptr [ecx + 0x14], edx
            //   b001                 | mov                 al, 1
            //   8be5                 | mov                 esp, ebp

        $sequence_5 = { ff742424 50 57 e8???????? 83c414 85c0 0f8483000000 }
            // n = 7, score = 200
            //   ff742424             | push                dword ptr [esp + 0x24]
            //   50                   | push                eax
            //   57                   | push                edi
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   85c0                 | test                eax, eax
            //   0f8483000000         | je                  0x89

        $sequence_6 = { f30f11040a f30f1045b4 f30f5c45b0 b804000000 6bc807 8b55fc f30f11040a }
            // n = 7, score = 200
            //   f30f11040a           | movss               dword ptr [edx + ecx], xmm0
            //   f30f1045b4           | movss               xmm0, dword ptr [ebp - 0x4c]
            //   f30f5c45b0           | subss               xmm0, dword ptr [ebp - 0x50]
            //   b804000000           | mov                 eax, 4
            //   6bc807               | imul                ecx, eax, 7
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   f30f11040a           | movss               dword ptr [edx + ecx], xmm0

        $sequence_7 = { e9???????? 837df40f 7e30 b804000000 69c8f0000000 8b5518 8b040a }
            // n = 7, score = 200
            //   e9????????           |                     
            //   837df40f             | cmp                 dword ptr [ebp - 0xc], 0xf
            //   7e30                 | jle                 0x32
            //   b804000000           | mov                 eax, 4
            //   69c8f0000000         | imul                ecx, eax, 0xf0
            //   8b5518               | mov                 edx, dword ptr [ebp + 0x18]
            //   8b040a               | mov                 eax, dword ptr [edx + ecx]

        $sequence_8 = { 8b95f0feffff f30f59040a f30f1185c0feffff f30f1085bcfeffff f30f5885b8feffff f30f1185dcfeffff f30f1085bcfeffff }
            // n = 7, score = 200
            //   8b95f0feffff         | mov                 edx, dword ptr [ebp - 0x110]
            //   f30f59040a           | mulss               xmm0, dword ptr [edx + ecx]
            //   f30f1185c0feffff     | movss               dword ptr [ebp - 0x140], xmm0
            //   f30f1085bcfeffff     | movss               xmm0, dword ptr [ebp - 0x144]
            //   f30f5885b8feffff     | addss               xmm0, dword ptr [ebp - 0x148]
            //   f30f1185dcfeffff     | movss               dword ptr [ebp - 0x124], xmm0
            //   f30f1085bcfeffff     | movss               xmm0, dword ptr [ebp - 0x144]

        $sequence_9 = { f30f1145d8 eb0a f30f1045f8 f30f1145d8 f30f1045d8 f30f1145d4 f30f1045d4 }
            // n = 7, score = 200
            //   f30f1145d8           | movss               dword ptr [ebp - 0x28], xmm0
            //   eb0a                 | jmp                 0xc
            //   f30f1045f8           | movss               xmm0, dword ptr [ebp - 8]
            //   f30f1145d8           | movss               dword ptr [ebp - 0x28], xmm0
            //   f30f1045d8           | movss               xmm0, dword ptr [ebp - 0x28]
            //   f30f1145d4           | movss               dword ptr [ebp - 0x2c], xmm0
            //   f30f1045d4           | movss               xmm0, dword ptr [ebp - 0x2c]

    condition:
        7 of them and filesize < 3743744
}