rule win_unidentified_091_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.unidentified_091."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_091"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? c744244801000000 488d4c2460 48895c2440 4c8d8734030000 48894c2438 4c8d0ddf721400 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   c744244801000000     | mov                 dword ptr [ebx + 0x20], eax
            //   488d4c2460           | dec                 esp
            //   48895c2440           | lea                 eax, [ebp - 0x78]
            //   4c8d8734030000       | xor                 edx, edx
            //   48894c2438           | dec                 eax
            //   4c8d0ddf721400       | lea                 ecx, [0x244643]

        $sequence_1 = { e8???????? 482be0 8b3a 488bd9 8b89d4050000 488bf2 85c9 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   482be0               | dec                 eax
            //   8b3a                 | add                 esp, 0x40
            //   488bd9               | inc                 ecx
            //   8b89d4050000         | pop                 esi
            //   488bf2               | ret                 
            //   85c9                 | dec                 eax

        $sequence_2 = { e9???????? 488d8ab00e0000 e9???????? 488d8ad00e0000 e9???????? 488d8af00e0000 e9???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   488d8ab00e0000       | dec                 eax
            //   e9????????           |                     
            //   488d8ad00e0000       | mov                 ecx, dword ptr [esi + 8]
            //   e9????????           |                     
            //   488d8af00e0000       | dec                 eax
            //   e9????????           |                     

        $sequence_3 = { 89742420 498b06 48634804 33d2 4a89543128 eb41 488b01 }
            // n = 7, score = 100
            //   89742420             | mov                 edx, ebx
            //   498b06               | dec                 eax
            //   48634804             | lea                 ecx, [ebp - 0x28]
            //   33d2                 | inc                 dword ptr [ebp - 8]
            //   4a89543128           | dec                 eax
            //   eb41                 | mov                 ecx, ebx
            //   488b01               | inc                 esp

        $sequence_4 = { eb6f 4c8b5048 4d85d2 7514 c74424207a020000 418d527c 41b884000000 }
            // n = 7, score = 100
            //   eb6f                 | mov                 dword ptr [esp + 0x10], esi
            //   4c8b5048             | dec                 eax
            //   4d85d2               | mov                 dword ptr [esp + 0x18], edi
            //   7514                 | cmp                 dword ptr [edx + 0x80], 0
            //   c74424207a020000     | dec                 eax
            //   418d527c             | lea                 esi, [0xffe632b3]
            //   41b884000000         | inc                 esp

        $sequence_5 = { 742e c7814007000000000000 488d15b7081400 488b8938060000 41b895030000 e8???????? 48c7833806000000000000 }
            // n = 7, score = 100
            //   742e                 | inc                 ebp
            //   c7814007000000000000     | xor    eax, dword ptr [edi + ecx*4 + 0x227de0]
            //   488d15b7081400       | inc                 ebp
            //   488b8938060000       | xor                 eax, dword ptr [edi + eax*4 + 0x2281e0]
            //   41b895030000         | inc                 ecx
            //   e8????????           |                     
            //   48c7833806000000000000     | mov    eax, ebx

        $sequence_6 = { eb0f 488bd3 488d0dabf12500 e8???????? 488b85d0010000 48634804 488d0524fe2500 }
            // n = 7, score = 100
            //   eb0f                 | dec                 eax
            //   488bd3               | mov                 ecx, edi
            //   488d0dabf12500       | dec                 eax
            //   e8????????           |                     
            //   488b85d0010000       | mov                 dword ptr [esp + 0x20], ecx
            //   48634804             | dec                 ecx
            //   488d0524fe2500       | mov                 ecx, esi

        $sequence_7 = { e8???????? 90 488bcb e8???????? 85c0 7525 488b4c2438 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   90                   | movaps              xmm6, xmmword ptr [esp + 0x40]
            //   488bcb               | dec                 eax
            //   e8????????           |                     
            //   85c0                 | add                 esp, 0x60
            //   7525                 | inc                 ecx
            //   488b4c2438           | pop                 edi

        $sequence_8 = { ffc3 e8???????? 3bd8 7cc6 41f6c708 0f85d0000000 4c8d058d0c1100 }
            // n = 7, score = 100
            //   ffc3                 | dec                 eax
            //   e8????????           |                     
            //   3bd8                 | mov                 dword ptr [ebp + 0x30], edi
            //   7cc6                 | jmp                 0x1891
            //   41f6c708             | dec                 ecx
            //   0f85d0000000         | mov                 ecx, dword ptr [ebp + ebx + 0x20]
            //   4c8d058d0c1100       | dec                 esp

        $sequence_9 = { eb03 890c90 8b4df3 48ffc2 4983c002 483bd1 72db }
            // n = 7, score = 100
            //   eb03                 | lea                 ecx, [ebp - 0x10]
            //   890c90               | dec                 eax
            //   8b4df3               | mov                 dword ptr [ebp - 0x40], eax
            //   48ffc2               | inc                 esp
            //   4983c002             | mov                 dword ptr [ebp + 0xe0], edx
            //   483bd1               | movzx               eax, byte ptr [ecx + 0x248]
            //   72db                 | mov                 dword ptr [ebp - 0x38], eax

    condition:
        7 of them and filesize < 5777408
}