MALPEDIA_Win_Killdisk_Auto

rule MALPEDIA_Win_Killdisk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "01ce24ac-2c12-538b-a3a7-492e0c9469f6"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.killdisk_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "ac404c07c1133d2b33943d3a9a261a1ec36ead25c1d19408d14c9adf6caf5592"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e9???????? 883424 ff742420 8f4500 9c 51 }
		$sequence_1 = { 57 8dbc2444030000 2bc1 8bf1 }
		$sequence_2 = { d1924dbeb698 760a d035???????? d6 d487 ce }
		$sequence_3 = { 8b4c2424 2bc8 894c244c 8b4c2430 2bc8 89542414 }
		$sequence_4 = { 8f44241c c64424148e c644240426 e8???????? 4e e8???????? 54 }
		$sequence_5 = { 7415 b907010000 8d7c2468 f3a5 8b431c }
		$sequence_6 = { 88742408 c70424ba7bbfa4 660fbae408 662dca11 e8???????? 881438 }
		$sequence_7 = { e8???????? 83c40c 6802040000 8d942484020000 6a00 52 }
		$sequence_8 = { 50 51 e8???????? 4e 80fcd7 }
		$sequence_9 = { 28d8 882424 e9???????? 66894500 66897c240c 882c24 }
		$sequence_10 = { 9c 6689742404 8d642450 e9???????? 89442424 }
		$sequence_11 = { 7407 56 ff15???????? 56 ff15???????? 85c0 }
		$sequence_12 = { 8d4c2404 51 b9???????? e8???????? 8bf0 e8???????? }
		$sequence_13 = { 0f8402020000 8b442418 85c0 0f84f6010000 }
		$sequence_14 = { 8b1495a098c201 8d440224 802080 884dfd 8065fd48 }
		$sequence_15 = { e9???????? 9c 9c 66894504 57 60 }

	condition:
		7 of them and filesize < 10817536
}