rule win_unidentified_100_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.unidentified_100."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_100"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? c644242000 eb0b 0fb6442420 fec0 88442420 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   c644242000           | dec                 eax
            //   eb0b                 | xor                 eax, esp
            //   0fb6442420           | dec                 eax
            //   fec0                 | mov                 dword ptr [esp + 0x30], eax
            //   88442420             | inc                 ebp

        $sequence_1 = { 488b4c2478 c604014a eb1c 48630424 }
            // n = 4, score = 200
            //   488b4c2478           | dec                 eax
            //   c604014a             | imul                ecx, ecx, 1
            //   eb1c                 | dec                 eax
            //   48630424             | mov                 edx, dword ptr [esp + 0x18]

        $sequence_2 = { 8d4408ff 4898 488b4c2420 0fb6542403 881401 0fb6442402 fec0 }
            // n = 7, score = 200
            //   8d4408ff             | dec                 eax
            //   4898                 | mov                 edx, dword ptr [esp + 0x40]
            //   488b4c2420           | dec                 esp
            //   0fb6542403           | lea                 ebx, [0x17f7e]
            //   881401               | dec                 ecx
            //   0fb6442402           | mov                 eax, dword ptr [ebx + edx*8]
            //   fec0                 | inc                 edx

        $sequence_3 = { 8b442404 390424 7d1e 48630424 488b4c2430 }
            // n = 5, score = 200
            //   8b442404             | dec                 eax
            //   390424               | lea                 edx, [edx + edx*8]
            //   7d1e                 | dec                 eax
            //   48630424             | mov                 eax, ecx
            //   488b4c2430           | dec                 eax

        $sequence_4 = { 488b4c2428 e8???????? c644242000 eb0b }
            // n = 4, score = 200
            //   488b4c2428           | lea                 edi, [0x18b70]
            //   e8????????           |                     
            //   c644242000           | dec                 eax
            //   eb0b                 | mov                 eax, ecx

        $sequence_5 = { 4898 0fb78444f0010000 25ff000000 8b4c2430 8d4c0901 }
            // n = 5, score = 200
            //   4898                 | arpl                cx, cx
            //   0fb78444f0010000     | dec                 eax
            //   25ff000000           | mov                 edx, dword ptr [esp + 0x50]
            //   8b4c2430             | movzx               eax, byte ptr [esp + eax + 0x2c]
            //   8d4c0901             | mov                 byte ptr [edx + ecx], al

        $sequence_6 = { 4883f870 0f869d010000 488b842490030000 4889442478 48c7442440ffffffff }
            // n = 5, score = 200
            //   4883f870             | xchg                dword ptr [edi + esi*8 + 0x28370], eax
            //   0f869d010000         | dec                 eax
            //   488b842490030000     | test                eax, eax
            //   4889442478           | jmp                 0x2a2
            //   48c7442440ffffffff     | inc    ecx

        $sequence_7 = { eb09 0fb60424 fec0 880424 0fb60424 83f808 7d5b }
            // n = 7, score = 200
            //   eb09                 | movzx               eax, byte ptr [esp]
            //   0fb60424             | imul                ecx, eax
            //   fec0                 | mov                 eax, ecx
            //   880424               | inc                 ecx
            //   0fb60424             | movzx               eax, byte ptr [eax + eax]
            //   83f808               | mov                 byte ptr [edx + ecx], al
            //   7d5b                 | jmp                 0x8f2

        $sequence_8 = { 488d942400150000 33c9 e8???????? 4533c9 4c8d8424a0270000 488d942400170000 33c9 }
            // n = 7, score = 200
            //   488d942400150000     | mov                 ecx, dword ptr [ebx]
            //   33c9                 | dec                 eax
            //   e8????????           |                     
            //   4533c9               | test                ecx, ecx
            //   4c8d8424a0270000     | je                  0xf80
            //   488d942400170000     | test                dl, dl
            //   33c9                 | je                  0xf8c

        $sequence_9 = { 8b9424c0200000 488d8c2400060000 ff15???????? 4889442448 83bc249020000000 0f8501010000 83bc249820000000 }
            // n = 7, score = 200
            //   8b9424c0200000       | dec                 eax
            //   488d8c2400060000     | cmp                 dword ptr [esp + 0x48], 0
            //   ff15????????         |                     
            //   4889442448           | je                  0x1fb
            //   83bc249020000000     | dec                 eax
            //   0f8501010000         | mov                 ecx, dword ptr [esp + 0x48]
            //   83bc249820000000     | add                 ecx, eax

    condition:
        7 of them and filesize < 372736
}