YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 0e49524fb4032b5ed236dbeb1d9877dc92b0acf10331462c72aacd0c64cd2449.

Scan Results

SHA256 hash: 0e49524fb4032b5ed236dbeb1d9877dc92b0acf10331462c72aacd0c64cd2449
File size:98'627 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: cfda75a2898de0a01663afd7e44892f0
SHA1 hash: 45d1a83fc544331684881bc9bd5b4064cfbcdc9d
SHA3-384 hash: 8477495fa513990243b6f62012e38b74aa4566797949569e498c97654f670ef1500b1ac954a1d557d12b5aa7a228f3cf
First seen:2024-10-18 05:10:26 UTC
Last seen:2024-10-18 05:10:26 UTC
Sightings:2
imphash : 826215fcca4f0bd0b8d2fa152b6c316f
Create hunting rule
ssdeep : 1536:TPnUVMef4nvBdSXAC0CcCgjCSCh9GGSurj+7:zUNcdSXvrC7
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 20f878f0e0e0f0d4
Create hunting rule

Tasks

You can browse the 10 most recent tasks associated with this file blow.

Task Information

Task ID:4959f6a8-8d0f-11ef-b6ec-42010aa4000b
File name:400000.96f6961d-3f18-47af-9ba3-2595d36a4a89.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Aspack-30
Create hunting rule
Signature:PUA.Win.Packer.Asprotect-3
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:ASPackv212AlexeySolodovnikov
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:ASProtectV2XDLLAlexeySolodovnikov
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:INDICATOR_EXE_Packed_ASPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ASPack
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.

Task Information

Task ID:496f93d9-8d0f-11ef-b6ec-42010aa4000b
File name:400000.96f6961d-3f18-47af-9ba3-2595d36a4a89.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Aspack-30
Create hunting rule
Signature:PUA.Win.Packer.Asprotect-3
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:ASPackv212AlexeySolodovnikov
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:ASProtectV2XDLLAlexeySolodovnikov
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:INDICATOR_EXE_Packed_ASPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ASPack
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.