rule win_volgmer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.volgmer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7406 ffd6 48895f18 488b4f10 4885c9 7406 }
            // n = 6, score = 200
            //   7406                 | dec                 eax
            //   ffd6                 | lea                 ecx, [ebp + 0x7e0]
            //   48895f18             | mov                 edx, esi
            //   488b4f10             | mov                 byte ptr [ebp + esi + 0x7e0], 0
            //   4885c9               | mov                 dword ptr [ebp + 0x914], eax
            //   7406                 | movups              xmmword ptr [ebp + 0x8e4], xmm1

        $sequence_1 = { 75ae 488b08 4533c9 48890a 448bc5 }
            // n = 5, score = 200
            //   75ae                 | mov                 byte ptr [ebp + 0x918], al
            //   488b08               | dec                 eax
            //   4533c9               | lea                 ecx, [ebp + 0x7e0]
            //   48890a               | mov                 edx, esi
            //   448bc5               | mov                 byte ptr [ebp + esi + 0x7e0], 0

        $sequence_2 = { 4533c0 498bd5 33c9 c744242800000008 }
            // n = 4, score = 200
            //   4533c0               | inc                 ebp
            //   498bd5               | xor                 eax, eax
            //   33c9                 | dec                 ecx
            //   c744242800000008     | mov                 edx, ebp

        $sequence_3 = { 898514090000 0f2805???????? 0fb605???????? 0f118de4080000 888518090000 }
            // n = 5, score = 200
            //   898514090000         | cmp                 esi, 3
            //   0f2805????????       |                     
            //   0fb605????????       |                     
            //   0f118de4080000       | ja                  0x31
            //   888518090000         | mov                 ecx, 0x12c

        $sequence_4 = { 448bc6 4889442460 488d8de0070000 e8???????? 8bd6 c68435e007000000 }
            // n = 6, score = 200
            //   448bc6               | mov                 esp, dword ptr [esp + 0x50]
            //   4889442460           | mov                 dword ptr [ebx + 0x500c0], ebp
            //   488d8de0070000       | mov                 dword ptr [ebx + 0x52e20], ebp
            //   e8????????           |                     
            //   8bd6                 | mov                 dword ptr [ebx + 0x50ea4], ebp
            //   c68435e007000000     | inc                 ecx

        $sequence_5 = { 4183fe03 772f b92c010000 ff15???????? 498b4d18 4c8bce }
            // n = 6, score = 200
            //   4183fe03             | inc                 ebp
            //   772f                 | cmova               eax, esi
            //   b92c010000           | add                 edi, dword ptr [esp + 0x88]
            //   ff15????????         |                     
            //   498b4d18             | inc                 ecx
            //   4c8bce               | cmp                 edi, esp

        $sequence_6 = { 33f6 458d44245f e8???????? 33c0 48897588 }
            // n = 5, score = 200
            //   33f6                 | jb                  0xffffffda
            //   458d44245f           | inc                 esp
            //   e8????????           |                     
            //   33c0                 | mov                 byte ptr [ebx + 0x52529], ah
            //   48897588             | dec                 esp

        $sequence_7 = { 33d2 0f1f00 410fb60416 880411 488d5201 84c0 }
            // n = 6, score = 200
            //   33d2                 | mov                 ecx, esi
            //   0f1f00               | xor                 esi, esi
            //   410fb60416           | inc                 ebp
            //   880411               | lea                 eax, [esp + 0x5f]
            //   488d5201             | xor                 eax, eax
            //   84c0                 | dec                 eax

        $sequence_8 = { 8bf7 8bc6 e9???????? 41b902000000 4533c0 33d2 }
            // n = 6, score = 200
            //   8bf7                 | mov                 dword ptr [ebp - 0x78], esi
            //   8bc6                 | inc                 esp
            //   e9????????           |                     
            //   41b902000000         | mov                 eax, esi
            //   4533c0               | dec                 eax
            //   33d2                 | mov                 dword ptr [esp + 0x60], eax

        $sequence_9 = { e8???????? e8???????? e8???????? c705????????04000000 }
            // n = 4, score = 200
            //   e8????????           |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   c705????????04000000     |     

        $sequence_10 = { 0fb684c8a87a6e00 c1e804 5d c20800 8bff }
            // n = 5, score = 100
            //   0fb684c8a87a6e00     | lea                 esp, [0xd96b]
            //   c1e804               | dec                 ecx
            //   5d                   | cmp                 ebx, esp
            //   c20800               | inc                 ecx
            //   8bff                 | mov                 edx, ecx

        $sequence_11 = { 6a03 53 6a02 6800000040 57 ff15???????? }
            // n = 6, score = 100
            //   6a03                 | mov                 ecx, 2
            //   53                   | inc                 ebp
            //   6a02                 | xor                 eax, eax
            //   6800000040           | xor                 edx, edx
            //   57                   | je                  8
            //   ff15????????         |                     

        $sequence_12 = { 8a4d08 8d41e0 3c5a 770f 0fbec1 0fb688887a7300 }
            // n = 6, score = 100
            //   8a4d08               | lea                 eax, [esp + 0x34]
            //   8d41e0               | push                0x200
            //   3c5a                 | push                eax
            //   770f                 | push                eax
            //   0fbec1               | lea                 ecx, [esp + 0x94]
            //   0fb688887a7300       | push                ecx

        $sequence_13 = { 448bcf c644242017 e8???????? 8bcb }
            // n = 4, score = 100
            //   448bcf               | sar                 edx, 0xc
            //   c644242017           | mov                 eax, edx
            //   e8????????           |                     
            //   8bcb                 | shr                 eax, 0x1f

        $sequence_14 = { 81c434020000 c3 8d442434 6800020000 50 ff15???????? }
            // n = 6, score = 100
            //   81c434020000         | dec                 eax
            //   c3                   | mov                 dword ptr [edx], ecx
            //   8d442434             | inc                 esp
            //   6800020000           | mov                 eax, ebp
            //   50                   | dec                 eax
            //   ff15????????         |                     

        $sequence_15 = { 8bec 8b4508 83f80b 7719 ff24851fb07200 6a04 }
            // n = 6, score = 100
            //   8bec                 | jne                 9
            //   8b4508               | push                0x2710
            //   83f80b               | jmp                 0xc
            //   7719                 | push                0xea60
            //   ff24851fb07200       | mov                 byte ptr [esp + 0x27], 0xff
            //   6a04                 | mov                 byte ptr [esp + 0x28], 0x3c

        $sequence_16 = { 3b7ddc 0f82eefeffff eb29 8b55d4 8a07 8b0c9580f16e00 }
            // n = 6, score = 100
            //   3b7ddc               | lea                 eax, [ebp + 0x90]
            //   0f82eefeffff         | nop                 word ptr [eax + eax]
            //   eb29                 | inc                 sp
            //   8b55d4               | cmp                 dword ptr [eax], ebp
            //   8a07                 | je                  0x17
            //   8b0c9580f16e00       | dec                 eax

        $sequence_17 = { 458bc5 498bcc e8???????? 85c0 0f84c1000000 }
            // n = 5, score = 100
            //   458bc5               | cmp                 dh, byte ptr [ebx]
            //   498bcc               | cmp                 ecx, dword ptr [ebx + 0x3b]
            //   e8????????           |                     
            //   85c0                 | push                edx
            //   0f84c1000000         | cmp                 ebx, dword ptr [esi + 0x3b]

        $sequence_18 = { 8975cc 8d041f 8975d0 8975e0 8975f0 c745f4fc7d6e00 }
            // n = 6, score = 100
            //   8975cc               | mov                 eax, esp
            //   8d041f               | sub                 eax, edi
            //   8975d0               | cmp                 eax, ebx
            //   8975e0               | inc                 esp
            //   8975f0               | mov                 ecx, edi
            //   c745f4fc7d6e00       | mov                 byte ptr [esp + 0x20], 0x17

        $sequence_19 = { 0f43c8 fec1 888c3ac4000500 6646896c8d02 6644896c9d02 }
            // n = 5, score = 100
            //   0f43c8               | sub                 esp, 0x88
            //   fec1                 | dec                 eax
            //   888c3ac4000500       | lea                 ecx, [0x114f5]
            //   6646896c8d02         | dec                 eax
            //   6644896c9d02         | mov                 dword ptr [esp + 0x58], eax

        $sequence_20 = { 4c8d0581f2ffff 4533c9 33d2 33c9 }
            // n = 4, score = 100
            //   4c8d0581f2ffff       | cmovae              ecx, eax
            //   4533c9               | inc                 cl
            //   33d2                 | mov                 byte ptr [edx + edi + 0x500c4], cl
            //   33c9                 | inc                 si

        $sequence_21 = { 894df0 8b34cd40a96e00 8b4d08 6a5a }
            // n = 4, score = 100
            //   894df0               | jmp                 0x2d
            //   8b34cd40a96e00       | cmp                 eax, -1
            //   8b4d08               | jne                 0x28
            //   6a5a                 | dec                 esp

        $sequence_22 = { 899df0f3ffff 8d4201 0f1f00 8a0a 42 84c9 }
            // n = 6, score = 100
            //   899df0f3ffff         | mov                 byte ptr [esp + 0x29], 0xa0
            //   8d4201               | mov                 byte ptr [esp + 0x2a], 0xb1
            //   0f1f00               | mov                 byte ptr [esp + 0x2b], 0xca
            //   8a0a                 | mov                 byte ptr [esp + 0x2c], 0x23
            //   42                   | add                 esp, 0x234
            //   84c9                 | ret                 

        $sequence_23 = { 8b4514 40 c745ecc89b7200 894df8 8945fc 64a100000000 8945e8 }
            // n = 7, score = 100
            //   8b4514               | add                 esp, 4
            //   40                   | cmp                 edx, ecx
            //   c745ecc89b7200       | cmp                 ebx, eax
            //   894df8               | cmp                 esp, ebp
            //   8945fc               | cmp                 ebx, dword ptr [ecx - 0x5ac361c4]
            //   64a100000000         | cmp                 al, 0xae
            //   8945e8               | cmp                 al, 0xb5

        $sequence_24 = { e8???????? 85c0 0f8474030000 4889bc24d8000000 }
            // n = 4, score = 100
            //   e8????????           |                     
            //   85c0                 | push                eax
            //   0f8474030000         | call                esi
            //   4889bc24d8000000     | mov                 dword ptr [edi + 0xc], 0

        $sequence_25 = { 7507 6810270000 eb05 6860ea0000 }
            // n = 4, score = 100
            //   7507                 | dec                 eax
            //   6810270000           | mov                 ecx, dword ptr [edi + 0x10]
            //   eb05                 | dec                 eax
            //   6860ea0000           | test                ecx, ecx

        $sequence_26 = { 89442464 8b4220 89442468 e8???????? }
            // n = 4, score = 100
            //   89442464             | mov                 dword ptr [ebp + ecx*4 + 2], ebp
            //   8b4220               | inc                 sp
            //   89442468             | mov                 dword ptr [ebp + ebx*4 + 2], ebp
            //   e8????????           |                     

        $sequence_27 = { 4881ec88000000 488d0df5140100 ff15???????? 488b05???????? 4889442458 }
            // n = 5, score = 100
            //   4881ec88000000       | xor                 ecx, ecx
            //   488d0df5140100       | mov                 dword ptr [esp + 0x28], 0x8000000
            //   ff15????????         |                     
            //   488b05????????       |                     
            //   4889442458           | dec                 eax

        $sequence_28 = { 450f47c6 ff15???????? 03bc2488000000 413bfc 72ce }
            // n = 5, score = 100
            //   450f47c6             | dec                 esp
            //   ff15????????         |                     
            //   03bc2488000000       | lea                 eax, [0xfffff281]
            //   413bfc               | inc                 ebp
            //   72ce                 | xor                 ecx, ecx

        $sequence_29 = { 745d 68c0d40100 ff95ecf7ffff ff049d30f66e00 68d0070000 ff95ecf7ffff }
            // n = 6, score = 100
            //   745d                 | sar                 edx, 8
            //   68c0d40100           | mov                 dword ptr [ebp - 0x31], edx
            //   ff95ecf7ffff         | movzx               ecx, byte ptr [ebp - 0x2f]
            //   ff049d30f66e00       | mov                 byte ptr [ebp - 0x37], dl
            //   68d0070000           | mov                 byte ptr [ebp - 0x39], cl
            //   ff95ecf7ffff         | movzx               ecx, byte ptr [ebp - 0x30]

        $sequence_30 = { 418bd1 c1fa08 8955cf 0fb64dd1 8855c9 884dc7 0fb64dd0 }
            // n = 7, score = 100
            //   418bd1               | movsx               eax, cl
            //   c1fa08               | movzx               ecx, byte ptr [eax + 0x737a88]
            //   8955cf               | mov                 eax, dword ptr [ebp + 0x14]
            //   0fb64dd1             | inc                 eax
            //   8855c9               | mov                 dword ptr [ebp - 0x14], 0x729bc8
            //   884dc7               | mov                 dword ptr [ebp - 8], ecx
            //   0fb64dd0             | mov                 dword ptr [ebp - 4], eax

        $sequence_31 = { 8bf0 8b470c 85c0 740a 50 ffd6 c7470c00000000 }
            // n = 7, score = 100
            //   8bf0                 | cmp                 al, 0xbd
            //   8b470c               | inc                 eax
            //   85c0                 | mov                 dword ptr [ebp - 0xa3c], eax
            //   740a                 | lea                 edx, [ebp - 0x630]
            //   50                   | shl                 eax, 9
            //   ffd6                 | lea                 ecx, [eax + 0x73f670]
            //   c7470c00000000       | sub                 edx, ecx

        $sequence_32 = { 0f83d5000000 660f1f440000 418bc4 2bc7 3bc3 }
            // n = 5, score = 100
            //   0f83d5000000         | push                0x3b
            //   660f1f440000         | jge                 0x46
            //   418bc4               | mov                 eax, 0x68db8bad
            //   2bc7                 | inc                 ecx
            //   3bc3                 | imul                eax

        $sequence_33 = { 6b45e430 8945e0 8d80d0e16e00 8945e4 }
            // n = 4, score = 100
            //   6b45e430             | mov                 ecx, ebx
            //   8945e0               | dec                 eax
            //   8d80d0e16e00         | mov                 ecx, edi
            //   8945e4               | dec                 eax

        $sequence_34 = { c1f906 6bd030 8b45fc 03148d80f16e00 8b00 894218 }
            // n = 6, score = 100
            //   c1f906               | mov                 ecx, esp
            //   6bd030               | test                eax, eax
            //   8b45fc               | je                  0xc9
            //   03148d80f16e00       | jae                 0xdb
            //   8b00                 | nop                 word ptr [eax + eax]
            //   894218               | inc                 ecx

        $sequence_35 = { f7d8 c703???????? 6a00 1bc0 c7430400000000 }
            // n = 5, score = 100
            //   f7d8                 | push                edi
            //   c703????????         |                     
            //   6a00                 | mov                 dword ptr [esp + 0x14], eax
            //   1bc0                 | mov                 edx, ebx
            //   c7430400000000       | mov                 esi, 0x104

        $sequence_36 = { c6442427ff c64424283c c6442429a0 c644242ab1 c644242bca c644242c23 }
            // n = 6, score = 100
            //   c6442427ff           | je                  0x15
            //   c64424283c           | jne                 0xffffffb0
            //   c6442429a0           | dec                 eax
            //   c644242ab1           | mov                 ecx, dword ptr [eax]
            //   c644242bca           | inc                 ebp
            //   c644242c23           | xor                 ecx, ecx

        $sequence_37 = { ff15???????? 89442414 8bd3 be04010000 }
            // n = 4, score = 100
            //   ff15????????         |                     
            //   89442414             | call                esi
            //   8bd3                 | dec                 eax
            //   be04010000           | mov                 dword ptr [edi + 0x18], ebx

        $sequence_38 = { 418bd5 ff15???????? 488bd8 4883f8ff 0f84d8000000 4c8d442468 ba7e660480 }
            // n = 7, score = 100
            //   418bd5               | mov                 eax, dword ptr fs:[0]
            //   ff15????????         |                     
            //   488bd8               | mov                 dword ptr [ebp - 0x18], eax
            //   4883f8ff             | mov                 esi, eax
            //   0f84d8000000         | mov                 eax, dword ptr [edi + 0xc]
            //   4c8d442468           | test                eax, eax
            //   ba7e660480           | je                  0x11

        $sequence_39 = { 40 8985c4f5ffff 8d95d0f9ffff c1e009 8d8870f67300 2bd1 }
            // n = 6, score = 100
            //   40                   | mov                 edx, dword ptr [esp + 0x14]
            //   8985c4f5ffff         | mov                 ecx, 0x10
            //   8d95d0f9ffff         | push                3
            //   c1e009               | push                ebx
            //   8d8870f67300         | push                2
            //   2bd1                 | push                0x40000000

        $sequence_40 = { 895c2418 897c241c 75e3 8b442410 8b542414 b910000000 }
            // n = 6, score = 100
            //   895c2418             | dec                 eax
            //   897c241c             | lea                 edx, [edx + 1]
            //   75e3                 | test                al, al
            //   8b442410             | mov                 esi, edi
            //   8b542414             | mov                 eax, esi
            //   b910000000           | inc                 ecx

        $sequence_41 = { 8b45e4 8b0c8580f16e00 8b45e8 f644012880 7446 0fbec3 83e800 }
            // n = 7, score = 100
            //   8b45e4               | inc                 ecx
            //   8b0c8580f16e00       | mov                 edx, ebp
            //   8b45e8               | dec                 eax
            //   f644012880           | mov                 ebx, eax
            //   7446                 | dec                 eax
            //   0fbec3               | cmp                 eax, -1
            //   83e800               | je                  0xe2

        $sequence_42 = { 3bd1 3bd8 3be5 3b993c9e3ca5 3cae 3cb5 3cbd }
            // n = 7, score = 100
            //   3bd1                 | test                ecx, ecx
            //   3bd8                 | je                  0x14
            //   3be5                 | call                edi
            //   3b993c9e3ca5         | mov                 dword ptr [esp + 0x18], ebx
            //   3cae                 | mov                 dword ptr [esp + 0x1c], edi
            //   3cb5                 | jne                 0xffffffe9
            //   3cbd                 | mov                 eax, dword ptr [esp + 0x10]

        $sequence_43 = { e8???????? eb2b 83f8ff 7526 4c8d256bd90000 493bdc }
            // n = 6, score = 100
            //   e8????????           |                     
            //   eb2b                 | test                cl, cl
            //   83f8ff               | mov                 cl, byte ptr [ebp + 8]
            //   7526                 | lea                 eax, [ecx - 0x20]
            //   4c8d256bd90000       | cmp                 al, 0x5a
            //   493bdc               | ja                  0x16

    condition:
        7 of them and filesize < 393216
}