DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document

rule DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document : FILE
{
	meta:
		description = "Detects documents generated by Phantom Crypter/Ancalog"
		author = "ditekSHen"
		id = "01e7f949-8ced-5355-978c-34d6e639e61a"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L551-L563"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e458be78ca8975d067110dc38119437b3ffe55afdbfdab47468c9ed74bba9f9d"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "910000-910001"
		snort3_sid = "910000"
		clamav_sig = "INDICATOR.RTF.AncalogExploitBuilderDocument"

	strings:
		$builder1 = "{\\*\\ancalog" ascii
		$builder2 = "\\ancalog" ascii

	condition:
		uint32( 0 ) == 0x74725c7b and 1 of ( $builder* )
}