MALPEDIA_Win_Apollo_Shadow_Auto

rule MALPEDIA_Win_Apollo_Shadow_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "76bde173-1488-5294-bcc3-d9c7e9a47266"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apollo_shadow"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.apollo_shadow_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "20a8ccbd2545463c3adba429f094df425b6b9ba8f9cf0dd77090b9aab1413193"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4c3bd9 7363 4983e0e0 f30f7e01 4983c220 660f60c0 660f71e008 }
		$sequence_1 = { 0f873c060000 e8???????? 660f6f05???????? f30f7f45f8 668975e8 85db 750f }
		$sequence_2 = { 41b806000000 488d150f3d0300 e8???????? 90 0f288424d0000000 660f7f8424d0000000 4c8d8424e8000000 }
		$sequence_3 = { e9???????? 498bc7 488d0dd7870200 83e03f 4d8be7 49c1fc06 4c8965e8 }
		$sequence_4 = { e8???????? 0fb7d8 e8???????? 448bcb 4c8bc0 33d2 488d0d63adfeff }
		$sequence_5 = { 498bd0 4c8d155d0a0300 3bcf 7622 498bc0 48c1f806 498bc8 }
		$sequence_6 = { 4c8bc3 488d4dff e8???????? 90 488975b7 488b4db7 4c8975b7 }
		$sequence_7 = { 7579 488d3dd4710200 ff05???????? 8b4314 90 a9c0040000 7561 }
		$sequence_8 = { 488bc3 48bdfeffffffffffff7f 482bc2 483bc5 0f87f5000000 4883f808 0f828f000000 }
		$sequence_9 = { 488d8af0000000 e9???????? 488d8ae0000000 e9???????? 488d8a10010000 e9???????? 488d8a58010000 }

	condition:
		7 of them and filesize < 710656
}