rule win_killdisk_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.killdisk."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { d035???????? d6 d487 ce be37b14781 7855 ce }
            // n = 7, score = 100
            //   d035????????         |                     
            //   d6                   | salc                
            //   d487                 | aam                 0x87
            //   ce                   | into                
            //   be37b14781           | mov                 esi, 0x8147b137
            //   7855                 | js                  0x57
            //   ce                   | into                

        $sequence_1 = { 668b0d???????? 8a15???????? 66894c2410 88542412 ff15???????? 8bd8 }
            // n = 6, score = 100
            //   668b0d????????       |                     
            //   8a15????????         |                     
            //   66894c2410           | mov                 word ptr [esp + 0x10], cx
            //   88542412             | mov                 byte ptr [esp + 0x12], dl
            //   ff15????????         |                     
            //   8bd8                 | mov                 ebx, eax

        $sequence_2 = { 52 c744243001000000 c744243c02000000 ff15???????? }
            // n = 4, score = 100
            //   52                   | push                edx
            //   c744243001000000     | mov                 dword ptr [esp + 0x30], 1
            //   c744243c02000000     | mov                 dword ptr [esp + 0x3c], 2
            //   ff15????????         |                     

        $sequence_3 = { a1???????? 33c4 89842468060000 53 56 8b7508 57 }
            // n = 7, score = 100
            //   a1????????           |                     
            //   33c4                 | xor                 eax, esp
            //   89842468060000       | mov                 dword ptr [esp + 0x668], eax
            //   53                   | push                ebx
            //   56                   | push                esi
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   57                   | push                edi

        $sequence_4 = { b001 5b 83c428 c3 5f }
            // n = 5, score = 100
            //   b001                 | mov                 al, 1
            //   5b                   | pop                 ebx
            //   83c428               | add                 esp, 0x28
            //   c3                   | ret                 
            //   5f                   | pop                 edi

        $sequence_5 = { e8???????? 83c40c 8b44240c 8d542408 52 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8b44240c             | mov                 eax, dword ptr [esp + 0xc]
            //   8d542408             | lea                 edx, dword ptr [esp + 8]
            //   52                   | push                edx

        $sequence_6 = { 85ff 0f841b020000 83ffff 0f8402020000 8b442418 85c0 }
            // n = 6, score = 100
            //   85ff                 | test                edi, edi
            //   0f841b020000         | je                  0x221
            //   83ffff               | cmp                 edi, -1
            //   0f8402020000         | je                  0x208
            //   8b442418             | mov                 eax, dword ptr [esp + 0x18]
            //   85c0                 | test                eax, eax

        $sequence_7 = { 680000a000 68???????? 56 ff15???????? 56 ff15???????? }
            // n = 6, score = 100
            //   680000a000           | push                0xa00000
            //   68????????           |                     
            //   56                   | push                esi
            //   ff15????????         |                     
            //   56                   | push                esi
            //   ff15????????         |                     

        $sequence_8 = { 807db600 0f8524ffffff 8b4df8 5f 5e 33cd }
            // n = 6, score = 100
            //   807db600             | cmp                 byte ptr [ebp - 0x4a], 0
            //   0f8524ffffff         | jne                 0xffffff2a
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   33cd                 | xor                 ecx, ebp

        $sequence_9 = { e8???????? d2cd 80d213 66c1e204 8b5500 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   d2cd                 | ror                 ch, cl
            //   80d213               | adc                 dl, 0x13
            //   66c1e204             | shl                 dx, 4
            //   8b5500               | mov                 edx, dword ptr [ebp]

        $sequence_10 = { 89442424 b8???????? 85c0 7511 32c0 }
            // n = 5, score = 100
            //   89442424             | mov                 dword ptr [esp + 0x24], eax
            //   b8????????           |                     
            //   85c0                 | test                eax, eax
            //   7511                 | jne                 0x13
            //   32c0                 | xor                 al, al

        $sequence_11 = { 9c 8d642428 e9???????? 60 8774241c 660fb6f3 }
            // n = 6, score = 100
            //   9c                   | pushfd              
            //   8d642428             | lea                 esp, dword ptr [esp + 0x28]
            //   e9????????           |                     
            //   60                   | pushal              
            //   8774241c             | xchg                dword ptr [esp + 0x1c], esi
            //   660fb6f3             | movzx               si, bl

        $sequence_12 = { 8d85c4feffff 6a00 50 c785c0feffff00000000 e8???????? 83c40c }
            // n = 6, score = 100
            //   8d85c4feffff         | lea                 eax, dword ptr [ebp - 0x13c]
            //   6a00                 | push                0
            //   50                   | push                eax
            //   c785c0feffff00000000     | mov    dword ptr [ebp - 0x140], 0
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_13 = { 60 4e 6681ff6148 f6d0 e9???????? 46 60 }
            // n = 7, score = 100
            //   60                   | pushal              
            //   4e                   | dec                 esi
            //   6681ff6148           | cmp                 di, 0x4861
            //   f6d0                 | not                 al
            //   e9????????           |                     
            //   46                   | inc                 esi
            //   60                   | pushal              

        $sequence_14 = { 5f 5b 837c242010 7209 55 }
            // n = 5, score = 100
            //   5f                   | pop                 edi
            //   5b                   | pop                 ebx
            //   837c242010           | cmp                 dword ptr [esp + 0x20], 0x10
            //   7209                 | jb                  0xb
            //   55                   | push                ebp

        $sequence_15 = { 89742418 e8???????? 83c40c 8d4c2418 51 }
            // n = 5, score = 100
            //   89742418             | mov                 dword ptr [esp + 0x18], esi
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8d4c2418             | lea                 ecx, dword ptr [esp + 0x18]
            //   51                   | push                ecx

        $sequence_16 = { e8???????? 66ffc6 e8???????? 9c 8f442420 ff3424 ff742424 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   66ffc6               | inc                 si
            //   e8????????           |                     
            //   9c                   | pushfd              
            //   8f442420             | pop                 dword ptr [esp + 0x20]
            //   ff3424               | push                dword ptr [esp]
            //   ff742424             | push                dword ptr [esp + 0x24]

        $sequence_17 = { 51 e8???????? 4e 80fcd7 60 }
            // n = 5, score = 100
            //   51                   | push                ecx
            //   e8????????           |                     
            //   4e                   | dec                 esi
            //   80fcd7               | cmp                 ah, 0xd7
            //   60                   | pushal              

        $sequence_18 = { 0facd001 53 d1ea 0500ecffff 8d4df0 }
            // n = 5, score = 100
            //   0facd001             | shrd                eax, edx, 1
            //   53                   | push                ebx
            //   d1ea                 | shr                 edx, 1
            //   0500ecffff           | add                 eax, 0xffffec00
            //   8d4df0               | lea                 ecx, dword ptr [ebp - 0x10]

        $sequence_19 = { 8944242c 89442430 6a1c 8d44241c 50 68???????? }
            // n = 6, score = 100
            //   8944242c             | mov                 dword ptr [esp + 0x2c], eax
            //   89442430             | mov                 dword ptr [esp + 0x30], eax
            //   6a1c                 | push                0x1c
            //   8d44241c             | lea                 eax, dword ptr [esp + 0x1c]
            //   50                   | push                eax
            //   68????????           |                     

        $sequence_20 = { c785e4fdffff00000000 8d75a6 8b06 8b4e08 }
            // n = 4, score = 100
            //   c785e4fdffff00000000     | mov    dword ptr [ebp - 0x21c], 0
            //   8d75a6               | lea                 esi, dword ptr [ebp - 0x5a]
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   8b4e08               | mov                 ecx, dword ptr [esi + 8]

        $sequence_21 = { 660fcf 87742404 87fe e8???????? }
            // n = 4, score = 100
            //   660fcf               | bswap               di
            //   87742404             | xchg                dword ptr [esp + 4], esi
            //   87fe                 | xchg                esi, edi
            //   e8????????           |                     

        $sequence_22 = { 32db 85ed 57 7507 32c0 e9???????? }
            // n = 6, score = 100
            //   32db                 | xor                 bl, bl
            //   85ed                 | test                ebp, ebp
            //   57                   | push                edi
            //   7507                 | jne                 9
            //   32c0                 | xor                 al, al
            //   e9????????           |                     

        $sequence_23 = { 881438 e8???????? 9c c6442408cf 894508 e9???????? }
            // n = 6, score = 100
            //   881438               | mov                 byte ptr [eax + edi], dl
            //   e8????????           |                     
            //   9c                   | pushfd              
            //   c6442408cf           | mov                 byte ptr [esp + 8], 0xcf
            //   894508               | mov                 dword ptr [ebp + 8], eax
            //   e9????????           |                     

    condition:
        7 of them and filesize < 10817536
}