rule win_wininetloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.wininetloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wininetloader"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7510 0fb611 0fb6c2 80fa28 7423 80fa29 741e }
            // n = 7, score = 100
            //   7510                 | dec                 eax
            //   0fb611               | lea                 esi, [edx + ecx]
            //   0fb6c2               | dec                 eax
            //   80fa28               | mov                 dword ptr [ebp + 0x5c0], esi
            //   7423                 | dec                 eax
            //   80fa29               | lea                 edi, [ebp + 0x5b0]
            //   741e                 | dec                 ecx

        $sequence_1 = { 4c8bac2480000000 90 493bdf 74db 0fb633 498bcd 410fb61424 }
            // n = 7, score = 100
            //   4c8bac2480000000     | nop                 
            //   90                   | dec                 eax
            //   493bdf               | mov                 dword ptr [edx + 0x28], ecx
            //   74db                 | dec                 eax
            //   0fb633               | mov                 eax, dword ptr [ebx + 8]
            //   498bcd               | dec                 eax
            //   410fb61424           | mov                 dword ptr [edx + 0x18], eax

        $sequence_2 = { 48897c2460 4d8bc5 488b542438 488bc8 e8???????? 4b8d042e 4889442458 }
            // n = 7, score = 100
            //   48897c2460           | dec                 eax
            //   4d8bc5               | mov                 dword ptr [ebx], ecx
            //   488b542438           | dec                 eax
            //   488bc8               | lea                 edx, [ebx + 8]
            //   e8????????           |                     
            //   4b8d042e             | dec                 eax
            //   4889442458           | lea                 ecx, [eax + 8]

        $sequence_3 = { 90 488d5508 48837d2008 480f435508 488b4518 4c8d0c42 4c8d4508 }
            // n = 7, score = 100
            //   90                   | mov                 eax, dword ptr [ecx + 0x18]
            //   488d5508             | and                 eax, 0xfffffff
            //   48837d2008           | cmp                 eax, 3
            //   480f435508           | jne                 0x526
            //   488b4518             | dec                 eax
            //   4c8d0c42             | lea                 eax, [0xf0f97]
            //   4c8d4508             | dec                 eax

        $sequence_4 = { e8???????? 3a03 7516 488bcf e8???????? 4c8b45f8 488b4df0 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   3a03                 | lea                 ecx, [ebx + 0x10]
            //   7516                 | dec                 esp
            //   488bcf               | lea                 eax, [ebp + 0x150]
            //   e8????????           |                     
            //   4c8b45f8             | dec                 eax
            //   488b4df0             | mov                 eax, 0xffffffff

        $sequence_5 = { 4c8be0 4889442450 4885db 7427 488b03 488bcb 488b4010 }
            // n = 7, score = 100
            //   4c8be0               | mov                 dword ptr [eax + 8], ebx
            //   4889442450           | dec                 eax
            //   4885db               | mov                 dword ptr [eax + 0x18], esi
            //   7427                 | dec                 eax
            //   488b03               | xor                 eax, esp
            //   488bcb               | dec                 eax
            //   488b4010             | mov                 dword ptr [ebp + 0x68], eax

        $sequence_6 = { 4c894d08 33db 448bf3 895c2470 49395910 752b 488d15b6ea1100 }
            // n = 7, score = 100
            //   4c894d08             | dec                 eax
            //   33db                 | lea                 eax, [0x282f7]
            //   448bf3               | dec                 eax
            //   895c2470             | cmp                 ebp, eax
            //   49395910             | jl                  0x42
            //   752b                 | test                edi, edi
            //   488d15b6ea1100       | dec                 eax

        $sequence_7 = { 3a8c2ab8a80e00 0f8585000000 488b03 48ffc2 8a08 48ffc0 488903 }
            // n = 7, score = 100
            //   3a8c2ab8a80e00       | dec                 ecx
            //   0f8585000000         | mov                 ecx, esp
            //   488b03               | jbe                 0x1e8b
            //   48ffc2               | mov                 edx, 0x1e
            //   8a08                 | dec                 eax
            //   48ffc0               | mov                 ecx, edi
            //   488903               | mov                 edx, dword ptr [ebx + 0x34]

        $sequence_8 = { 488d1d48970500 807e5704 7704 488b5e48 48ffc7 803c3b00 75f7 }
            // n = 7, score = 100
            //   488d1d48970500       | dec                 eax
            //   807e5704             | test                esi, esi
            //   7704                 | inc                 ebp
            //   488b5e48             | xor                 edi, edi
            //   48ffc7               | inc                 ebp
            //   803c3b00             | mov                 byte ptr [esp], bh
            //   75f7                 | inc                 ebp

        $sequence_9 = { eb21 48c74424200f000000 4c8d0d54fd0900 4533c0 418d500f 488d4c2430 e8???????? }
            // n = 7, score = 100
            //   eb21                 | jae                 0x5e8
            //   48c74424200f000000     | mov    edx, 0x20
            //   4c8d0d54fd0900       | dec                 eax
            //   4533c0               | sub                 edx, esi
            //   418d500f             | dec                 eax
            //   488d4c2430           | mov                 dword ptr [edi + 0x18], 0xf
            //   e8????????           |                     

    condition:
        7 of them and filesize < 2659328
}