MALPEDIA_Win_Bootwreck_Auto

rule MALPEDIA_Win_Bootwreck_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1378c9fb-61e2-5eb0-9121-77bd373bc04f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bootwreck"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.bootwreck_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "7afa6ef33adc76004c8c91f2c6154bc64f62f404c6ab0afbfa8361808ddef3dd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f9 66d3ef 660fcf 0fb738 f8 29db }
		$sequence_1 = { 97 4e 1db48b7a71 f8 8766ad fa 2976a7 }
		$sequence_2 = { 8dac246971318a 8dada1cd3823 66f7d5 5d 689c422a44 9c 60 }
		$sequence_3 = { 9c 8d642428 e9???????? 9c 8d642410 e8???????? 28c3 }
		$sequence_4 = { 60 67b41b 4f b666 6d 5a }
		$sequence_5 = { 397dfc 0f847affffff 0fb6d2 3b55f8 7523 8b8c88380c0000 6a03 }
		$sequence_6 = { 8b742420 9c 8a7c2404 8da9483b0901 66bb2520 890f c644241c95 }
		$sequence_7 = { 5a 3d1eff0e9c 5d 22812152a18e 33dd fa 7599 }
		$sequence_8 = { 88642404 8d64243c e8???????? 80d988 8b4dfc 9c 60 }
		$sequence_9 = { 5a 7df3 293f bd5b0c762c 8400 47 f77e54 }

	condition:
		7 of them and filesize < 10821632
}