rule win_unidentified_109_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.unidentified_109."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_109"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? b88bfeffff e9???????? 0fb78b88030000 4c896c2468 41bd00800000 0fb7c1 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   b88bfeffff           | mov                 ebx, eax
            //   e9????????           |                     
            //   0fb78b88030000       | test                eax, eax
            //   4c896c2468           | je                  0x605
            //   41bd00800000         | dec                 eax
            //   0fb7c1               | mov                 ebp, dword ptr [esp + 0x30]

        $sequence_1 = { ff45bf 33c0 8945b7 4585f6 0f856dffffff eb03 8b45b7 }
            // n = 7, score = 100
            //   ff45bf               | mov                 eax, 0xfffffeb8
            //   33c0                 | ret                 
            //   8945b7               | xor                 eax, eax
            //   4585f6               | mov                 byte ptr [ecx + 0x3c9], 0
            //   0f856dffffff         | inc                 cx
            //   eb03                 | cmp                 eax, eax
            //   8b45b7               | inc                 ecx

        $sequence_2 = { 41c1c00a 41c1c10b 4503cb 448d994efd53a9 4133c1 4103c6 4403d0 }
            // n = 7, score = 100
            //   41c1c00a             | dec                 esp
            //   41c1c10b             | lea                 edi, [ecx + 0x160]
            //   4503cb               | dec                 esp
            //   448d994efd53a9       | lea                 esi, [ecx + 0xe0]
            //   4133c1               | movzx               ecx, byte ptr [ecx + 0x228]
            //   4103c6               | test                ecx, ecx
            //   4403d0               | je                  0x1e29

        $sequence_3 = { e8???????? 8bf0 85c0 0f8591000000 488d55e0 4c8bc3 488bcb }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8bf0                 | mov                 eax, eax
            //   85c0                 | inc                 ecx
            //   0f8591000000         | rol                 eax, 0x1e
            //   488d55e0             | and                 eax, ebx
            //   4c8bc3               | inc                 ecx
            //   488bcb               | mov                 edx, ecx

        $sequence_4 = { ffc8 410f48c6 4585c0 7e38 4898 660f1f440000 493bc6 }
            // n = 7, score = 100
            //   ffc8                 | lea                 ebx, [eax + 1]
            //   410f48c6             | dec                 eax
            //   4585c0               | lea                 eax, [ebp + 0x60]
            //   7e38                 | inc                 ecx
            //   4898                 | call                esp
            //   660f1f440000         | mov                 ebx, eax
            //   493bc6               | test                eax, eax

        $sequence_5 = { 413bde 0f8709010000 0fb6142a 80fa80 7230 0fb6d2 83e27f }
            // n = 7, score = 100
            //   413bde               | mov                 esi, dword ptr [esp + 0x98]
            //   0f8709010000         | dec                 eax
            //   0fb6142a             | mov                 ebx, dword ptr [esp + 0xa8]
            //   80fa80               | dec                 eax
            //   7230                 | lea                 ecx, [ebp - 9]
            //   0fb6d2               | jmp                 0x1466
            //   83e27f               | mov                 eax, dword ptr [ebp + 0xf]

        $sequence_6 = { 41bbbafeffff e9???????? 448bce 4c8bc7 488bd5 488bcb e8???????? }
            // n = 7, score = 100
            //   41bbbafeffff         | lea                 esi, [esi + 9]
            //   e9????????           |                     
            //   448bce               | lea                 ecx, [esi + 4]
            //   4c8bc7               | dec                 eax
            //   488bd5               | add                 edi, dword ptr [ebx + 0xf8]
            //   488bcb               | je                  0x181d
            //   e8????????           |                     

        $sequence_7 = { 413bd0 0f92c0 2d2dcbb22c 014168 44394968 81516c344dd334 4439516c }
            // n = 7, score = 100
            //   413bd0               | jmp                 0x132e
            //   0f92c0               | inc                 ebp
            //   2d2dcbb22c           | cmp                 edi, ebp
            //   014168               | jg                  0x131d
            //   44394968             | dec                 eax
            //   81516c344dd334       | lea                 ecx, [ebp - 0x21]
            //   4439516c             | inc                 ebp

        $sequence_8 = { 418bc8 410bc9 418bd2 23cb 0bc8 c1c205 81c1dcbc1b8f }
            // n = 7, score = 100
            //   418bc8               | call                esi
            //   410bc9               | jmp                 0x2de
            //   418bd2               | dec                 ecx
            //   23cb                 | mov                 ecx, edi
            //   0bc8                 | dec                 eax
            //   c1c205               | mov                 dword ptr [esp + 0x70], esi
            //   81c1dcbc1b8f         | dec                 eax

        $sequence_9 = { 41c1c20e 4403d1 41c1c00a 41c1c10a 4133c0 448d99e9766d7a 4123c2 }
            // n = 7, score = 100
            //   41c1c20e             | mov                 edx, 0x200
            //   4403d1               | mov                 dword ptr [ebp + 0x588], edi
            //   41c1c00a             | inc                 esp
            //   41c1c10a             | mov                 esi, edi
            //   4133c0               | xor                 edi, edi
            //   448d99e9766d7a       | mov                 edx, 0x800c
            //   4123c2               | dec                 ecx

    condition:
        7 of them and filesize < 723968
}