rule win_killdisk_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.killdisk."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 55 56 8d542408 e8???????? }
            // n = 4, score = 100
            //   55                   | push                ebp
            //   56                   | push                esi
            //   8d542408             | lea                 edx, [esp + 8]
            //   e8????????           |                     

        $sequence_1 = { 881438 e8???????? 9c c6442408cf 894508 }
            // n = 5, score = 100
            //   881438               | mov                 byte ptr [eax + edi], dl
            //   e8????????           |                     
            //   9c                   | pushfd              
            //   c6442408cf           | mov                 byte ptr [esp + 8], 0xcf
            //   894508               | mov                 dword ptr [ebp + 8], eax

        $sequence_2 = { ff15???????? 6a2c e8???????? 8b2d???????? }
            // n = 4, score = 100
            //   ff15????????         |                     
            //   6a2c                 | push                0x2c
            //   e8????????           |                     
            //   8b2d????????         |                     

        $sequence_3 = { 8d642430 e9???????? ff742404 66894500 }
            // n = 4, score = 100
            //   8d642430             | lea                 esp, [esp + 0x30]
            //   e9????????           |                     
            //   ff742404             | push                dword ptr [esp + 4]
            //   66894500             | mov                 word ptr [ebp], ax

        $sequence_4 = { 85c0 750e 56 b301 ff15???????? }
            // n = 5, score = 100
            //   85c0                 | test                eax, eax
            //   750e                 | jne                 0x10
            //   56                   | push                esi
            //   b301                 | mov                 bl, 1
            //   ff15????????         |                     

        $sequence_5 = { 5e 32c0 5d c3 85ed 7635 }
            // n = 6, score = 100
            //   5e                   | pop                 esi
            //   32c0                 | xor                 al, al
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   85ed                 | test                ebp, ebp
            //   7635                 | jbe                 0x37

        $sequence_6 = { 8b4500 eb02 8bc5 8d3c58 }
            // n = 4, score = 100
            //   8b4500               | mov                 eax, dword ptr [ebp]
            //   eb02                 | jmp                 4
            //   8bc5                 | mov                 eax, ebp
            //   8d3c58               | lea                 edi, [eax + ebx*2]

        $sequence_7 = { e8???????? d2cd 80d213 66c1e204 8b5500 f8 66c1d902 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   d2cd                 | ror                 ch, cl
            //   80d213               | adc                 dl, 0x13
            //   66c1e204             | shl                 dx, 4
            //   8b5500               | mov                 edx, dword ptr [ebp]
            //   f8                   | clc                 
            //   66c1d902             | rcr                 cx, 2

        $sequence_8 = { 55 8bec 83e4f8 83ec0c 85f6 57 }
            // n = 6, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83e4f8               | and                 esp, 0xfffffff8
            //   83ec0c               | sub                 esp, 0xc
            //   85f6                 | test                esi, esi
            //   57                   | push                edi

        $sequence_9 = { 60 9c 8f442428 882424 881c24 e8???????? d2cd }
            // n = 7, score = 100
            //   60                   | pushal              
            //   9c                   | pushfd              
            //   8f442428             | pop                 dword ptr [esp + 0x28]
            //   882424               | mov                 byte ptr [esp], ah
            //   881c24               | mov                 byte ptr [esp], bl
            //   e8????????           |                     
            //   d2cd                 | ror                 ch, cl

        $sequence_10 = { e8???????? 8b8c2430080000 83c404 84c0 }
            // n = 4, score = 100
            //   e8????????           |                     
            //   8b8c2430080000       | mov                 ecx, dword ptr [esp + 0x830]
            //   83c404               | add                 esp, 4
            //   84c0                 | test                al, al

        $sequence_11 = { c1e81f 03c2 3bc8 7331 8b7e08 c644241000 }
            // n = 6, score = 100
            //   c1e81f               | shr                 eax, 0x1f
            //   03c2                 | add                 eax, edx
            //   3bc8                 | cmp                 ecx, eax
            //   7331                 | jae                 0x33
            //   8b7e08               | mov                 edi, dword ptr [esi + 8]
            //   c644241000           | mov                 byte ptr [esp + 0x10], 0

        $sequence_12 = { c64424044f 8d642454 e9???????? 880424 8774242c 9c }
            // n = 6, score = 100
            //   c64424044f           | mov                 byte ptr [esp + 4], 0x4f
            //   8d642454             | lea                 esp, [esp + 0x54]
            //   e9????????           |                     
            //   880424               | mov                 byte ptr [esp], al
            //   8774242c             | xchg                dword ptr [esp + 0x2c], esi
            //   9c                   | pushfd              

        $sequence_13 = { d035???????? d6 d487 ce be37b14781 7855 ce }
            // n = 7, score = 100
            //   d035????????         |                     
            //   d6                   | salc                
            //   d487                 | aam                 0x87
            //   ce                   | into                
            //   be37b14781           | mov                 esi, 0x8147b137
            //   7855                 | js                  0x57
            //   ce                   | into                

        $sequence_14 = { e9???????? e9???????? e9???????? f3a4 81d66e3ddd77 8b7c2430 66d3fe }
            // n = 7, score = 100
            //   e9????????           |                     
            //   e9????????           |                     
            //   e9????????           |                     
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   81d66e3ddd77         | adc                 esi, 0x77dd3d6e
            //   8b7c2430             | mov                 edi, dword ptr [esp + 0x30]
            //   66d3fe               | sar                 si, cl

        $sequence_15 = { 6816cc2923 46 66892c24 9c 8d64244c e9???????? 9c }
            // n = 7, score = 100
            //   6816cc2923           | push                0x2329cc16
            //   46                   | inc                 esi
            //   66892c24             | mov                 word ptr [esp], bp
            //   9c                   | pushfd              
            //   8d64244c             | lea                 esp, [esp + 0x4c]
            //   e9????????           |                     
            //   9c                   | pushfd              

    condition:
        7 of them and filesize < 10817536
}