MALPEDIA_Win_Regphantom_Auto

rule MALPEDIA_Win_Regphantom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4fd1b40c-c84f-5f70-86d8-1cc93b62ccb1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regphantom"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.regphantom_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "1065aaffb23ab98c1e55164453e8d73634186ae637ebd218f1488fb56fb9be31"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488b4508 488b08 4883c101 488b4508 488908 8b0d???????? 8b05???????? }
		$sequence_1 = { 83e101 83f900 0f94c2 83f80a 0f9cc0 08c2 b833fbe6de }
		$sequence_2 = { 89c1 488b4508 8908 488b4510 c70000000000 8b0d???????? 8b05???????? }
		$sequence_3 = { b98706d3f6 f6c201 0f45c1 8945c0 e9???????? 488b45d8 }
		$sequence_4 = { 4889e2 488955f0 488908 48b84282cd736822e120 480305???????? 488d0d32faffff 4883ec20 }
		$sequence_5 = { 2da9f8c8c5 0f8429020000 e9???????? 8b45b0 2d8ac76fc9 0f845e020000 e9???????? }
		$sequence_6 = { 88450e 8b0d???????? 8b05???????? 89ca 83ea01 0fafca 83e101 }
		$sequence_7 = { b8805d9d8d b9aadb55d5 f6c201 0f45c1 8945c0 e9???????? }
		$sequence_8 = { ffd0 4883c420 c745e8e3f795bc e9???????? 488b0d???????? 488b05???????? 4831c1 }
		$sequence_9 = { 2d2795afa3 0f84f40a0000 e9???????? 8b45a4 2d2e173da4 0f8447080000 e9???????? }

	condition:
		7 of them and filesize < 123904
}