NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 08e94e5b6ba4cf4548bea22277e7d820884dee257c69fdfbaad21014c1f1e97e.

Scan Results

SHA256 hash: 08e94e5b6ba4cf4548bea22277e7d820884dee257c69fdfbaad21014c1f1e97e
File size:475'455 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: a63d38285ec898387c534da16f8670e5
SHA1 hash: 2f918ec1a1c1a97d1d943dded082aa7136334649
SHA3-384 hash: 36b15eb659f0b4ca261625149f78bfa40a87914d1fe30ec8080864d3fa83c130b24f9664e39d3ecd4fa2faa80c71cf6b
First seen:2023-04-17 21:34:48 UTC
Last seen:Never
Sightings:1
imphash : 17ed737e8e77e97fd1eb6ad9ba5d3eae
Create hunting rule
ssdeep : 6144:682p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbYBil0:sp4pNfz3ymJnJ8QCFkxCaQTOl2WF
TLSH : T1A2A46C26B2E08473D1732A349D0B966D9C26BE517E28A9863FEC1D4C9F3C781743A1D7
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:adc9ff28-dd67-11ed-866d-42010aa4000b
File name:a63d38285ec898387c534da16f8670e5
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Aspack-29
Create hunting rule
Signature:PUA.Win.Packer.Aspack-30
Create hunting rule
Signature:PUA.Win.Packer.Asprotect-3
Create hunting rule
Signature:Sanesecurity.Malware.29047.BadMsg.UNOFFICIAL
Create hunting rule
Signature:Win.Dropper.Mepaow-9786631-0
Create hunting rule
Signature:Win.Trojan.Autorun-7409
Create hunting rule
Signature:Win.Trojan.C9f02fb-9936592-0
Create hunting rule
Signature:Win.Virus.Lamer-6733340-0
Create hunting rule
Signature:Win.Virus.Stihat-9753082-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CMD_Shutdown
Create hunting rule
Author:adm1n_usa32
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.