MALPEDIA_Win_Phorpiex_Auto

rule MALPEDIA_Win_Phorpiex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1d354567-9f59-5789-85ab-bc6421356506"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.phorpiex_auto.yar#L1-L289"
		license_url = "N/A"
		logic_hash = "8a18b4fa1b41f6fd5fa83c797ce891de8d2d28d05c11921b76b5a67e4c3f417c"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a00 ff15???????? ff15???????? 50 e8???????? }
		$sequence_1 = { ff15???????? 85c0 740f 6a07 }
		$sequence_2 = { ff15???????? 85c0 741f 6880000000 }
		$sequence_3 = { 6a00 6a00 6a20 6a00 6a00 6a00 8b5508 }
		$sequence_4 = { e8???????? 83c410 6a00 6a02 6a02 6a00 6a00 }
		$sequence_5 = { 50 e8???????? 83c404 e8???????? e8???????? ff15???????? 6a00 }
		$sequence_6 = { 6a01 6a00 68???????? e8???????? 83c40c 33c0 }
		$sequence_7 = { 68???????? ff15???????? 8d85f8fdffff 50 68???????? }
		$sequence_8 = { 6a00 6a00 682a800000 6a00 }
		$sequence_9 = { 52 683f000f00 6a00 68???????? 6802000080 ff15???????? 85c0 }
		$sequence_10 = { 6a01 ff15???????? ff15???????? b001 }
		$sequence_11 = { ff15???????? 6a00 ff15???????? 85c0 7418 ff15???????? }
		$sequence_12 = { 8811 8b4508 83c001 894508 e9???????? 8b4d08 c60100 }
		$sequence_13 = { 68???????? ff15???????? e9???????? 8d45fc 50 }
		$sequence_14 = { f7f9 81c210270000 52 e8???????? }
		$sequence_15 = { 0fb745fc 0fb74dc4 0fb6540dc8 0fb64405c8 33c2 0fb74dfc }
		$sequence_16 = { 837dfc00 7416 8b4df8 51 }
		$sequence_17 = { 837df800 7429 8b45f8 50 ff15???????? 8945fc 837dfc00 }
		$sequence_18 = { f7f9 52 ff15???????? 6a00 6a00 6a00 }
		$sequence_19 = { 7508 6a00 ff15???????? 6804010000 }
		$sequence_20 = { 6a21 50 e8???????? c60000 }
		$sequence_21 = { 50 e8???????? 59 59 85c0 0f85c0000000 }
		$sequence_22 = { 3d00010000 7504 83c8ff c3 }
		$sequence_23 = { 75de eb0a 85ff 740e 803e00 }
		$sequence_24 = { c744241400000000 e8???????? 6880000000 8d4c2438 6a00 }
		$sequence_25 = { 803800 7412 50 8d44242c 50 e8???????? }
		$sequence_26 = { 52 e8???????? 99 b960ea0000 }
		$sequence_27 = { 663bc2 72f7 53 33c0 56 }
		$sequence_28 = { 50 8d45ec 50 6805000020 }
		$sequence_29 = { 57 68e8030000 ff15???????? e8???????? be???????? }
		$sequence_30 = { 8d45f8 50 8d45e4 50 6805000020 }

	condition:
		7 of them and filesize < 2490368
}