rule win_typehash_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.typehash."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typehash"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff249568534000 8bc7 ba03000000 83e904 720c 83e003 03c8 }
            // n = 7, score = 100
            //   ff249568534000       | jmp                 dword ptr [edx*4 + 0x405368]
            //   8bc7                 | mov                 eax, edi
            //   ba03000000           | mov                 edx, 3
            //   83e904               | sub                 ecx, 4
            //   720c                 | jb                  0xe
            //   83e003               | and                 eax, 3
            //   03c8                 | add                 ecx, eax

        $sequence_1 = { 8bf9 3bc7 7302 8bf8 8b6c2430 }
            // n = 5, score = 100
            //   8bf9                 | mov                 edi, ecx
            //   3bc7                 | cmp                 eax, edi
            //   7302                 | jae                 4
            //   8bf8                 | mov                 edi, eax
            //   8b6c2430             | mov                 ebp, dword ptr [esp + 0x30]

        $sequence_2 = { 56 57 895c2438 8a442423 53 8d4c242c 899c24d8120000 }
            // n = 7, score = 100
            //   56                   | push                esi
            //   57                   | push                edi
            //   895c2438             | mov                 dword ptr [esp + 0x38], ebx
            //   8a442423             | mov                 al, byte ptr [esp + 0x23]
            //   53                   | push                ebx
            //   8d4c242c             | lea                 ecx, dword ptr [esp + 0x2c]
            //   899c24d8120000       | mov                 dword ptr [esp + 0x12d8], ebx

        $sequence_3 = { 50 b8bc120000 64892500000000 e8???????? 53 55 33db }
            // n = 7, score = 100
            //   50                   | push                eax
            //   b8bc120000           | mov                 eax, 0x12bc
            //   64892500000000       | mov                 dword ptr fs:[0], esp
            //   e8????????           |                     
            //   53                   | push                ebx
            //   55                   | push                ebp
            //   33db                 | xor                 ebx, ebx

        $sequence_4 = { 85f6 7419 0fb6da f683c13c410004 7406 8816 46 }
            // n = 7, score = 100
            //   85f6                 | test                esi, esi
            //   7419                 | je                  0x1b
            //   0fb6da               | movzx               ebx, dl
            //   f683c13c410004       | test                byte ptr [ebx + 0x413cc1], 4
            //   7406                 | je                  8
            //   8816                 | mov                 byte ptr [esi], dl
            //   46                   | inc                 esi

        $sequence_5 = { e8???????? 8b442418 8bc8 2bcf 3bce 7302 8bf1 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b442418             | mov                 eax, dword ptr [esp + 0x18]
            //   8bc8                 | mov                 ecx, eax
            //   2bcf                 | sub                 ecx, edi
            //   3bce                 | cmp                 ecx, esi
            //   7302                 | jae                 4
            //   8bf1                 | mov                 esi, ecx

        $sequence_6 = { 53 55 8d4c2418 e8???????? 84c0 }
            // n = 5, score = 100
            //   53                   | push                ebx
            //   55                   | push                ebp
            //   8d4c2418             | lea                 ecx, dword ptr [esp + 0x18]
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_7 = { 8dbc2485010000 889c2484010000 f3ab 66ab aa b91f000000 }
            // n = 6, score = 100
            //   8dbc2485010000       | lea                 edi, dword ptr [esp + 0x185]
            //   889c2484010000       | mov                 byte ptr [esp + 0x184], bl
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   66ab                 | stosw               word ptr es:[edi], ax
            //   aa                   | stosb               byte ptr es:[edi], al
            //   b91f000000           | mov                 ecx, 0x1f

        $sequence_8 = { 45 e8???????? 83c404 8bf4 }
            // n = 4, score = 100
            //   45                   | inc                 ebp
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8bf4                 | mov                 esi, esp

        $sequence_9 = { 52 51 e8???????? 83c430 c6000a 80600100 8bc7 }
            // n = 7, score = 100
            //   52                   | push                edx
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c430               | add                 esp, 0x30
            //   c6000a               | mov                 byte ptr [eax], 0xa
            //   80600100             | and                 byte ptr [eax + 1], 0
            //   8bc7                 | mov                 eax, edi

    condition:
        7 of them and filesize < 180224
}

rule win_typehash_w0 {
    meta:
        author = "Jeff White (karttoon@gmail.com) @noottrak"
        date = "15APR2020"
        hash = "d81ba465fe59e7d600f7ab0e8161246a5badd8ae2c3084f76442fb49f6585e95"
        description = "Detects an observed Negastealer campaign payload"
        source = "https://github.com/karttoon/iocs/blob/899dac6045a73045baa8966a16b7402d625ee26b/Negasteal/troj_win_negasteal.yar"

        malpedia_rule_date = "20200817"
        malpedia_hash = ""
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typehash"
        malpedia_version = "20201007"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
	    $s1 = "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30"
	    $s2 = "news.php"
	    $s3 = "http://%s/%s"
	    $s4 = "type=0"
	    $s5 = "time=%s"
    condition:
	    all of them
}