Dolphin X Mutation Engine Artifacts
Detects PE builds exhibiting the co-occurring structural anomalies produced by Dolphin X's opt-in mutation engine: a stripped Rich header AND zeroed compile timestamp occurring together, a normal-entropy (non-packed) code section alongside multiple separate non-code sections re-encrypted at high entropy per build, and an unusually small/shuffled import table, all bounded to a plausible small-agent file size. Requiring several indicators simultaneously (rather than any single trait) filters out generic packers and compilers that only exhibit one superficial anomaly such as a bare timestamp or Rich header change, or that compress the entire binary (including code) to uniformly high entropy.
YARA
