rule win_shrinklocker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.shrinklocker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shrinklocker"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488bf9 f0ff05???????? 751f 488d1dabc90300 488bcb e8???????? 488d05dcca0300 }
            // n = 7, score = 100
            //   488bf9               | mov                 eax, 0x3e9
            //   f0ff05????????       |                     
            //   751f                 | je                  0x1e5
            //   488d1dabc90300       | dec                 eax
            //   488bcb               | mov                 eax, dword ptr [esp + 0x90]
            //   e8????????           |                     
            //   488d05dcca0300       | cmp                 dword ptr [eax + 0x84], 0

        $sequence_1 = { b804000000 486bc012 488b4c2470 0fb78401a40a0000 488b4c2470 8b8910170000 d3e0 }
            // n = 7, score = 100
            //   b804000000           | dec                 eax
            //   486bc012             | mov                 ecx, dword ptr [esp + 0x30]
            //   488b4c2470           | dec                 eax
            //   0fb78401a40a0000     | mov                 eax, dword ptr [eax + 0x10]
            //   488b4c2470           | dec                 eax
            //   8b8910170000         | sub                 eax, ecx
            //   d3e0                 | dec                 eax

        $sequence_2 = { 89442438 eb1c 8b0424 c1e807 }
            // n = 4, score = 100
            //   89442438             | lea                 ecx, [esp + 0x60]
            //   eb1c                 | mov                 edx, ebp
            //   8b0424               | dec                 eax
            //   c1e807               | lea                 edi, [0x1e415]

        $sequence_3 = { 03442424 488b8c2480000000 488b09 89411c 837c243000 0f8478fcffff 488b842480000000 }
            // n = 7, score = 100
            //   03442424             | dec                 eax
            //   488b8c2480000000     | lea                 edx, [0x3fc9b]
            //   488b09               | dec                 eax
            //   89411c               | lea                 ecx, [esp + 0x3e0]
            //   837c243000           | dec                 eax
            //   0f8478fcffff         | lea                 ecx, [esp + 0x348]
            //   488b842480000000     | dec                 eax

        $sequence_4 = { 8b442404 83c008 89442404 8b442478 8b4c2408 23c8 8bc1 }
            // n = 7, score = 100
            //   8b442404             | dec                 eax
            //   83c008               | cmp                 dword ptr [esp + 0x98], eax
            //   89442404             | jne                 0xaf1
            //   8b442478             | dec                 esp
            //   8b4c2408             | mov                 ecx, dword ptr [esp + 0x28]
            //   23c8                 | dec                 esp
            //   8bc1                 | mov                 eax, dword ptr [esp + 0x20]

        $sequence_5 = { 0fb6442451 88442452 488b8c2420010000 e8???????? 0fb6442452 488b8c2400010000 4833cc }
            // n = 7, score = 100
            //   0fb6442451           | mov                 ecx, ebx
            //   88442452             | dec                 ecx
            //   488b8c2420010000     | add                 edx, ebx
            //   e8????????           |                     
            //   0fb6442452           | dec                 ecx
            //   488b8c2400010000     | lea                 eax, [ebx + 1]
            //   4833cc               | dec                 eax

        $sequence_6 = { 0fb7442404 25ff0f0000 6689442408 0fb70424 83f803 7533 488b442410 }
            // n = 7, score = 100
            //   0fb7442404           | cmp                 byte ptr [ecx + eax], ah
            //   25ff0f0000           | jne                 0xf68
            //   6689442408           | dec                 eax
            //   0fb70424             | lea                 edx, [ebp - 0x20]
            //   83f803               | dec                 eax
            //   7533                 | mov                 ecx, eax
            //   488b442410           | dec                 ecx

        $sequence_7 = { b905000000 482bc8 488bc1 48898424a0000000 488b8424d0000000 8b8c24a0000000 894808 }
            // n = 7, score = 100
            //   b905000000           | mov                 ecx, dword ptr [esp + 0x40]
            //   482bc8               | dec                 eax
            //   488bc1               | add                 ecx, eax
            //   48898424a0000000     | dec                 eax
            //   488b8424d0000000     | mov                 eax, ecx
            //   8b8c24a0000000       | dec                 esp
            //   894808               | mov                 eax, dword ptr [esp + 0x50]

        $sequence_8 = { 488d0dfab00200 488b04d1 42804cf03802 492bfa 48d1ff 03ff e9???????? }
            // n = 7, score = 100
            //   488d0dfab00200       | add                 ebx, ebp
            //   488b04d1             | dec                 eax
            //   42804cf03802         | add                 ebx, ecx
            //   492bfa               | dec                 eax
            //   48d1ff               | sub                 edi, ebx
            //   03ff                 | dec                 eax
            //   e9????????           |                     

        $sequence_9 = { 4883c227 482bf1 488d46f8 4883f81f 0f878f000000 488bf1 488bce }
            // n = 7, score = 100
            //   4883c227             | mov                 eax, dword ptr [esp + 8]
            //   482bf1               | inc                 eax
            //   488d46f8             | mov                 ecx, dword ptr [esp]
            //   4883f81f             | sub                 ecx, eax
            //   0f878f000000         | mov                 eax, ecx
            //   488bf1               | mov                 dword ptr [esp], eax
            //   488bce               | mov                 eax, dword ptr [esp + 0x10]

    condition:
        7 of them and filesize < 10490880
}