Task Information
Task ID: 1ecb011a-8138-11f0-8fb7-42010aa4000b
File name: 4e35761cab450753839d351bfaa0fcce
Task parameters: ClamAV scan: True
Unpack: False
Share file: True
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: Borland
Alert
Author: malware-lu
TLP: TLP:WHITE
Repository:
Rule name: CP_AllMal_Detector
Alert
Author: DiegoAnalytics
Description: CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
TLP: TLP:WHITE
Repository: YARAify
Rule name: DebuggerCheck__API
Alert
Reference: https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP: TLP:WHITE
Rule name: Detect_PyInstaller
Alert
Author: Obscurity Labs LLC
Description: Detects PyInstaller compiled executables across platforms
TLP: TLP:WHITE
Rule name: FreddyBearDropper
Alert
Author: Dwarozh Hoshiar
Description: Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP: TLP:WHITE
Repository: YARAify
Rule name: classified
Author: classified
Description: classified
Reference: classified
TLP : TLP:AMBER
Rule name: MAL_Malware_Imphash_Mar23_1
Alert
Author: Arnim Rupp
Description: Detects malware by known bad imphash or rich_pe_header_hash
Reference: https://yaraify.abuse.ch/statistics/
TLP: TLP:WHITE
Repository: Neo23x0
Rule name: PyInstaller
Alert
Author: @bartblaze
Description: Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP: TLP:WHITE
Repository: bartblaze
Rule name: shellcode
Alert
Author: nex
Description: Matched shellcode byte patterns
TLP: TLP:WHITE
Repository: MalwareBazaar
Rule name: Sus_Obf_Enc_Spoof_Hide_PE
Alert
Author: XiAnzheng
Description: Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP: TLP:WHITE
Repository: YARAify
Rule name: upxHook
Alert
Author: @r3dbU7z
Description: Detect artifacts from 'upxHook' - modification of UPX packer
Reference: https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
TLP: TLP:WHITE
Repository: MalwareBazaar
Rule name: classified
Author: classified
Description: classified
Reference: classified
TLP : TLP:GREEN
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter