rule win_unidentified_100_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.unidentified_100."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_100"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb0b 0fb6442422 fec8 88442422 0fb6442422 83f801 7c35 }
            // n = 7, score = 200
            //   eb0b                 | lea                 ebx, [0x18996]
            //   0fb6442422           | inc                 ecx
            //   fec8                 | mov                 edi, 0x100
            //   88442422             | dec                 esp
            //   0fb6442422           | lea                 esp, [0x6940]
            //   83f801               | inc                 bp
            //   7c35                 | cmp                 dword ptr [esi], edi

        $sequence_1 = { 88040a eb44 48630424 837c841002 7520 48630424 }
            // n = 6, score = 200
            //   88040a               | inc                 ebp
            //   eb44                 | mov                 ebp, ecx
            //   48630424             | dec                 eax
            //   837c841002           | lea                 ecx, [0xfffeeec0]
            //   7520                 | dec                 esp
            //   48630424             | mov                 dword ptr [ebp - 0x19], eax

        $sequence_2 = { 488b8c2418040000 488b542470 0fb6941488000000 881401 ebb2 }
            // n = 5, score = 200
            //   488b8c2418040000     | dec                 eax
            //   488b542470           | mov                 dword ptr [ecx + 0x48], edx
            //   0fb6941488000000     | jmp                 0xde6
            //   881401               | dec                 eax
            //   ebb2                 | lea                 edx, [0x123a4]

        $sequence_3 = { 8d048503000000 4898 0fb64c2420 8d0c8d03000000 4863c9 488b542448 }
            // n = 6, score = 200
            //   8d048503000000       | dec                 eax
            //   4898                 | mov                 dword ptr [esp + 0x50], edx
            //   0fb64c2420           | dec                 esp
            //   8d0c8d03000000       | mov                 eax, dword ptr [esp + 0xc8]
            //   4863c9               | inc                 ecx
            //   488b542448           | movzx               edx, byte ptr [eax + ecx]

        $sequence_4 = { 4889442458 48837c245800 7402 eb02 eb9e 48837c245800 }
            // n = 6, score = 200
            //   4889442458           | dec                 eax
            //   48837c245800         | mov                 eax, ecx
            //   7402                 | dec                 eax
            //   eb02                 | div                 dword ptr [esp + 0xc8]
            //   eb9e                 | mov                 dword ptr [esp + 0x98], eax
            //   48837c245800         | mov                 eax, dword ptr [esp + 0x20a0]

        $sequence_5 = { 48837c244000 7441 4c8d8c24b0070000 4533c0 488d9424e0060000 }
            // n = 5, score = 200
            //   48837c244000         | imul                ecx, ecx, 1
            //   7441                 | dec                 eax
            //   4c8d8c24b0070000     | mov                 edx, dword ptr [esp + 0x18]
            //   4533c0               | mov                 byte ptr [edx + ecx], al
            //   488d9424e0060000     | mov                 ecx, 1

        $sequence_6 = { 833c2410 0f8d4a020000 48630424 488b4c2470 }
            // n = 4, score = 200
            //   833c2410             | dec                 eax
            //   0f8d4a020000         | mov                 eax, dword ptr [0x30]
            //   48630424             | dec                 eax
            //   488b4c2470           | lea                 edx, [0x1faf6]

        $sequence_7 = { b90a000000 ff15???????? 48c744242800000000 c744242000000000 41b9ffffffff 4c8d842420070000 488b942458090000 }
            // n = 7, score = 200
            //   b90a000000           | mov                 byte ptr [esp + ecx + 0xc0], al
            //   ff15????????         |                     
            //   48c744242800000000     | jmp    0x1506
            //   c744242000000000     | jmp                 0x150b
            //   41b9ffffffff         | movzx               eax, word ptr [esp + eax*2 + 0x1f0]
            //   4c8d842420070000     | and                 eax, 0xff
            //   488b942458090000     | mov                 ecx, dword ptr [esp + 0x30]

        $sequence_8 = { 33c8 8bc1 88442401 0fb6442420 2580000000 88442402 0fb6442420 }
            // n = 7, score = 200
            //   33c8                 | dec                 eax
            //   8bc1                 | mov                 ecx, ebx
            //   88442401             | jmp                 0xd9
            //   0fb6442420           | dec                 eax
            //   2580000000           | lea                 eax, [0x1416a]
            //   88442402             | dec                 eax
            //   0fb6442420           | cmp                 ecx, eax

        $sequence_9 = { 488d842430030000 4889442420 4c8b8c24b8200000 4c8d8424c00a0000 488d9424f0030000 }
            // n = 5, score = 200
            //   488d842430030000     | mov                 esp, ecx
            //   4889442420           | dec                 ecx
            //   4c8b8c24b8200000     | mov                 ebp, eax
            //   4c8d8424c00a0000     | dec                 esp
            //   488d9424f0030000     | mov                 ebp, edx

    condition:
        7 of them and filesize < 372736
}