rule win_unidentified_078_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.unidentified_078."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_078"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3c18 0f8483000000 3c1c 740d }
            // n = 4, score = 200
            //   3c18                 | dec                 ecx
            //   0f8483000000         | cmp                 ebx, eax
            //   3c1c                 | jl                  0x32
            //   740d                 | inc                 edx

        $sequence_1 = { ffd0 ebc9 ffd0 ebc5 }
            // n = 4, score = 200
            //   ffd0                 | mov                 dword ptr [esp + 0x30], eax
            //   ebc9                 | dec                 eax
            //   ffd0                 | mov                 edx, dword ptr [esp + 0x30]
            //   ebc5                 | mov                 edx, 0x2c

        $sequence_2 = { 80fa0d 0f8421010000 80fa1b 0f8576010000 ba02000000 e8???????? }
            // n = 6, score = 200
            //   80fa0d               | mov                 eax, dword ptr [ebp + 0x10]
            //   0f8421010000         | dec                 esp
            //   80fa1b               | mov                 edx, esp
            //   0f8576010000         | dec                 eax
            //   ba02000000           | lea                 ecx, [0x255c8]
            //   e8????????           |                     

        $sequence_3 = { 0f84ca000000 0f8fe5000000 80fa07 0f85b8010000 ba02000000 }
            // n = 5, score = 200
            //   0f84ca000000         | mov                 ecx, dword ptr [esp + 0xc]
            //   0f8fe5000000         | mov                 dword ptr [eax], 1
            //   80fa07               | dec                 esp
            //   0f85b8010000         | lea                 ecx, [edi + esi]
            //   ba02000000           | dec                 eax

        $sequence_4 = { 771b 3c10 0f8406020000 0f87bb010000 }
            // n = 4, score = 200
            //   771b                 | jmp                 0x30e
            //   3c10                 | mov                 edx, 2
            //   0f8406020000         | dec                 esp
            //   0f87bb010000         | mov                 eax, dword ptr [ecx]

        $sequence_5 = { e9???????? 80fa0c 0f8412010000 0f8cee000000 80fa0d }
            // n = 5, score = 200
            //   e9????????           |                     
            //   80fa0c               | dec                 eax
            //   0f8412010000         | lea                 ecx, [0x2c34]
            //   0f8cee000000         | lea                 ecx, [0x660c]
            //   80fa0d               | dec                 eax

        $sequence_6 = { 0f8f8f000000 80fa20 0f8d28020000 80fa0a 0f8417010000 7f39 80fa08 }
            // n = 7, score = 200
            //   0f8f8f000000         | jl                  0x99
            //   80fa20               | xor                 eax, eax
            //   0f8d28020000         | dec                 eax
            //   80fa0a               | mov                 ecx, dword ptr [esi]
            //   0f8417010000         | dec                 eax
            //   7f39                 | cmp                 ecx, 0xfff
            //   80fa08               | jbe                 0x85

        $sequence_7 = { e8???????? 84c0 7467 f60701 7562 }
            // n = 5, score = 200
            //   e8????????           |                     
            //   84c0                 | cmp                 edx, eax
            //   7467                 | mov                 edx, dword ptr [ebx + 8]
            //   f60701               | dec                 eax
            //   7562                 | mov                 eax, edi

        $sequence_8 = { 8a44010f 3c5c 7419 3c2f 7415 }
            // n = 5, score = 200
            //   8a44010f             | dec                 esp
            //   3c5c                 | or                  edx, ecx
            //   7419                 | dec                 eax
            //   3c2f                 | and                 ecx, 0x1ff
            //   7415                 | dec                 eax

        $sequence_9 = { 3c1c 740d 3c16 0f855a020000 }
            // n = 4, score = 200
            //   3c1c                 | mov                 dl, byte ptr [esi + eax + 0x10]
            //   740d                 | cmp                 ebp, eax
            //   3c16                 | jg                  0xffffff61
            //   0f855a020000         | test                al, al

    condition:
        7 of them and filesize < 688128
}