rule win_unidentified_124_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.unidentified_124."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_124"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c78570020000b58dbb54 c78574020000fa4e5ed6 c78578020000de8a5b94 c7857c0200006a82d4cf c785800200001da5bd0f c78584020000bf53fb55 c78588020000f8f600c0 }
            // n = 7, score = 100
            //   c78570020000b58dbb54     | mov    ecx, dword ptr [esp + 0x38]
            //   c78574020000fa4e5ed6     | dec    eax
            //   c78578020000de8a5b94     | xor    ecx, esp
            //   c7857c0200006a82d4cf     | dec    eax
            //   c785800200001da5bd0f     | add    esp, 0x48
            //   c78584020000bf53fb55     | ret    
            //   c78588020000f8f600c0     | jne    0x108f

        $sequence_1 = { 8bf8 e8???????? e9???????? 448975d4 660f1f840000000000 488b05???????? 488d55d0 }
            // n = 7, score = 100
            //   8bf8                 | shr                 ebx, 0x19
            //   e8????????           |                     
            //   e9????????           |                     
            //   448975d4             | inc                 ecx
            //   660f1f840000000000     | movzx    eax, byte ptr [esi + 0x11]
            //   488b05????????       |                     
            //   488d55d0             | dec                 esp

        $sequence_2 = { e9???????? 498b07 488d4dc8 48894c2420 4c8d45d2 498bcf 4533c9 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   498b07               | je                  0x1493
            //   488d4dc8             | mov                 ecx, dword ptr [ebp + 0x7f]
            //   48894c2420           | mov                 edx, ecx
            //   4c8d45d2             | and                 edx, 0xffff0000
            //   498bcf               | dec                 eax
            //   4533c9               | mov                 dword ptr [ebp - 0x39], edi

        $sequence_3 = { 8b4b1c 4803cf 8b0491 4803c7 48894650 41ffc6 443b7318 }
            // n = 7, score = 100
            //   8b4b1c               | dec                 esp
            //   4803cf               | mov                 eax, ebp
            //   8b0491               | dec                 eax
            //   4803c7               | mov                 edx, esi
            //   48894650             | dec                 eax
            //   41ffc6               | mov                 ecx, edi
            //   443b7318             | or                  ecx, 0xffffffff

        $sequence_4 = { e8???????? 488d8d80000000 e9???????? c7858000000014ac0a05 c78584000000d4350882 c78588000000921adb06 c7858c00000078a718f0 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488d8d80000000       | mov                 ebx, dword ptr [esp + 0x30]
            //   e9????????           |                     
            //   c7858000000014ac0a05     | dec    eax
            //   c78584000000d4350882     | mov    esi, dword ptr [esp + 0x38]
            //   c78588000000921adb06     | mov    dword ptr [edi + 0x35], 0x302444c7
            //   c7858c00000078a718f0     | mov    byte ptr [esp + 0x20], bl

        $sequence_5 = { 48897c2420 4d8bc5 498bd4 48c7c1ffffffff e8???????? 85c0 0f85c9000000 }
            // n = 7, score = 100
            //   48897c2420           | movdqu              xmm1, xmmword ptr [ebp + eax + 0xf0]
            //   4d8bc5               | inc                 ecx
            //   498bd4               | movq                mm0, qword ptr [edx + eax]
            //   48c7c1ffffffff       | pxor                xmm1, xmm0
            //   e8????????           |                     
            //   85c0                 | inc                 ecx
            //   0f85c9000000         | movq                qword ptr [eax + eax], mm1

        $sequence_6 = { 33c0 e9???????? 65488b042530000000 4889b424e8050000 488b4830 488b4160 498bce }
            // n = 7, score = 100
            //   33c0                 | mov                 dword ptr [ebp + 0xe0], 0x91bdb9d9
            //   e9????????           |                     
            //   65488b042530000000     | mov    dword ptr [ebp + 0xe4], 0x62dc54ba
            //   4889b424e8050000     | mov                 dword ptr [ebp + 0xd0], 0xbc5b8ed2
            //   488b4830             | mov                 dword ptr [ebp + 0xd4], 0xc3dcb67a
            //   488b4160             | mov                 dword ptr [ebp + 0xd8], 0x3bb98519
            //   498bce               | mov                 dword ptr [ebp + 0xdc], 0x79f367bf

        $sequence_7 = { c78518010000d286db91 c7851c010000f8929ecb c785200100005914bf8c c785240100007f4c6de9 c7852801000029c3a840 c7852c0100000e435c23 c785300100008b977f02 }
            // n = 7, score = 100
            //   c78518010000d286db91     | mov    ecx, dword ptr [eax]
            //   c7851c010000f8929ecb     | jne    0x1b8f
            //   c785200100005914bf8c     | dec    eax
            //   c785240100007f4c6de9     | lea    eax, [ecx + 0x1fff]
            //   c7852801000029c3a840     | dec    eax
            //   c7852c0100000e435c23     | and    eax, 0xffffe000
            //   c785300100008b977f02     | jmp    0x1b9c

        $sequence_8 = { e8???????? 4c8d8508010000 33d2 488bcb e8???????? 4883bef800000000 0f84c00c0000 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c8d8508010000       | inc                 ebx
            //   33d2                 | mov                 dword ptr [ebp + 0x27], eax
            //   488bcb               | dec                 eax
            //   e8????????           |                     
            //   4883bef800000000     | mov                 dword ptr [ebp + 0x1f], 8
            //   0f84c00c0000         | dec                 eax

        $sequence_9 = { 8bf8 3d8f2f0000 0f85ca000000 4180fe02 0f8d26010000 488b05???????? 4c8d45a0 }
            // n = 7, score = 100
            //   8bf8                 | dec                 esp
            //   3d8f2f0000           | lea                 ecx, [ebp + 0x80]
            //   0f85ca000000         | inc                 ecx
            //   4180fe02             | mov                 eax, esp
            //   0f8d26010000         | inc                 ecx
            //   488b05????????       |                     
            //   4c8d45a0             | mov                 eax, 0x20007

    condition:
        7 of them and filesize < 1437696
}