rule win_xpan_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.xpan."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpan"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83ec2c e8???????? 85c0 89c3 0f84ba010000 8b6c2440 85ed }
            // n = 7, score = 400
            //   83ec2c               | sub                 esp, 0x2c
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   89c3                 | mov                 ebx, eax
            //   0f84ba010000         | je                  0x1c0
            //   8b6c2440             | mov                 ebp, dword ptr [esp + 0x40]
            //   85ed                 | test                ebp, ebp

        $sequence_1 = { 89d8 89ef 84c9 0f84f8fdffff 89c3 8b442440 89fd }
            // n = 7, score = 400
            //   89d8                 | mov                 eax, ebx
            //   89ef                 | mov                 edi, ebp
            //   84c9                 | test                cl, cl
            //   0f84f8fdffff         | je                  0xfffffdfe
            //   89c3                 | mov                 ebx, eax
            //   8b442440             | mov                 eax, dword ptr [esp + 0x40]
            //   89fd                 | mov                 ebp, edi

        $sequence_2 = { 0f8dc6000000 8b1c24 8d0c1b 8b5c2438 034b04 894b08 8b0c24 }
            // n = 7, score = 400
            //   0f8dc6000000         | jge                 0xcc
            //   8b1c24               | mov                 ebx, dword ptr [esp]
            //   8d0c1b               | lea                 ecx, [ebx + ebx]
            //   8b5c2438             | mov                 ebx, dword ptr [esp + 0x38]
            //   034b04               | add                 ecx, dword ptr [ebx + 4]
            //   894b08               | mov                 dword ptr [ebx + 8], ecx
            //   8b0c24               | mov                 ecx, dword ptr [esp]

        $sequence_3 = { 8b4010 8b1c38 891c24 e8???????? 891c24 89442404 89f1 }
            // n = 7, score = 400
            //   8b4010               | mov                 eax, dword ptr [eax + 0x10]
            //   8b1c38               | mov                 ebx, dword ptr [eax + edi]
            //   891c24               | mov                 dword ptr [esp], ebx
            //   e8????????           |                     
            //   891c24               | mov                 dword ptr [esp], ebx
            //   89442404             | mov                 dword ptr [esp + 4], eax
            //   89f1                 | mov                 ecx, esi

        $sequence_4 = { 894c2414 e8???????? 8b4c2414 0fb6542418 85c9 0f8494000000 8b442444 }
            // n = 7, score = 400
            //   894c2414             | mov                 dword ptr [esp + 0x14], ecx
            //   e8????????           |                     
            //   8b4c2414             | mov                 ecx, dword ptr [esp + 0x14]
            //   0fb6542418           | movzx               edx, byte ptr [esp + 0x18]
            //   85c9                 | test                ecx, ecx
            //   0f8494000000         | je                  0x9a
            //   8b442444             | mov                 eax, dword ptr [esp + 0x44]

        $sequence_5 = { 3a55b9 0f8211fdffff 85ff 0f94c2 83fe08 0f94c0 08c2 }
            // n = 7, score = 400
            //   3a55b9               | cmp                 dl, byte ptr [ebp - 0x47]
            //   0f8211fdffff         | jb                  0xfffffd17
            //   85ff                 | test                edi, edi
            //   0f94c2               | sete                dl
            //   83fe08               | cmp                 esi, 8
            //   0f94c0               | sete                al
            //   08c2                 | or                  dl, al

        $sequence_6 = { 807d9800 8b459c 0f843f0a0000 8b7828 8b4d08 bb01000000 85c9 }
            // n = 7, score = 400
            //   807d9800             | cmp                 byte ptr [ebp - 0x68], 0
            //   8b459c               | mov                 eax, dword ptr [ebp - 0x64]
            //   0f843f0a0000         | je                  0xa45
            //   8b7828               | mov                 edi, dword ptr [eax + 0x28]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   bb01000000           | mov                 ebx, 1
            //   85c9                 | test                ecx, ecx

        $sequence_7 = { 8b4de4 8b01 8d5108 39d0 7408 890424 e8???????? }
            // n = 7, score = 400
            //   8b4de4               | mov                 ecx, dword ptr [ebp - 0x1c]
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   8d5108               | lea                 edx, [ecx + 8]
            //   39d0                 | cmp                 eax, edx
            //   7408                 | je                  0xa
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     

        $sequence_8 = { bf10000000 c745c816000000 e9???????? 8b45d0 0fbeda 8945cc 0fb645bb }
            // n = 7, score = 400
            //   bf10000000           | mov                 edi, 0x10
            //   c745c816000000       | mov                 dword ptr [ebp - 0x38], 0x16
            //   e9????????           |                     
            //   8b45d0               | mov                 eax, dword ptr [ebp - 0x30]
            //   0fbeda               | movsx               ebx, dl
            //   8945cc               | mov                 dword ptr [ebp - 0x34], eax
            //   0fb645bb             | movzx               eax, byte ptr [ebp - 0x45]

        $sequence_9 = { 83c601 898300010000 88140b 39f7 889304010000 0f8462180000 3dff000000 }
            // n = 7, score = 400
            //   83c601               | add                 esi, 1
            //   898300010000         | mov                 dword ptr [ebx + 0x100], eax
            //   88140b               | mov                 byte ptr [ebx + ecx], dl
            //   39f7                 | cmp                 edi, esi
            //   889304010000         | mov                 byte ptr [ebx + 0x104], dl
            //   0f8462180000         | je                  0x1868
            //   3dff000000           | cmp                 eax, 0xff

    condition:
        7 of them and filesize < 3235840
}