YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 1387bb65434bb64b52eafaf911de228684fb63db8ebc4b6d338b6ebd2407dab5
.
Scan Results
SHA256 hash: | 1387bb65434bb64b52eafaf911de228684fb63db8ebc4b6d338b6ebd2407dab5 | |
---|---|---|
File size: | 6'354'354 bytes | |
File download: | Original | |
MIME type: | application/x-dosexec | |
MD5 hash: | 110dc2baa13b66bc650b15cabab4b99a | |
SHA1 hash: | 22451a5a3cec54e11d1092eb819740457e541438 | |
SHA3-384 hash: | e126a372246879fc6161e3b297b48cb362d0687574d3a618b59f9b8ddc6d710c62176b73e23988d31569f4442c27926b | |
First seen: | 2025-08-24 22:20:24 UTC | |
Last seen: | Never | |
Sightings: | 1 | |
imphash : | 7af08cef0ea52b162bcd639588b66a38 | |
ssdeep : | 98304:V3mSGj/pi+K1EHy9BC7m1VwWdxx9NUFkQx753uWuCyyx:UbHyl16WdF2kQnjy | |
TLSH : | n/a | |
telfhash : | n/a | |
gimphash : | n/a | |
dhash icon : | 00928e8e8686b800 |
Tasks
There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
Task ID: | 87fb0fdf-8138-11f0-8fb7-42010aa4000b | |
---|---|---|
File name: | 400000.explorer.exe | |
Task parameters: | ClamAV scan: | True |
Unpack: | False | |
Share file: | True |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
Signature: | Win.Malware.Reconyc-9978691-0 |
---|
Signature: | Win.Packed.0000436da-9976370-0 |
---|
Signature: | Win.Packed.0000436da-9978792-0 |
---|
Signature: | Win.Trojan.VBGeneric-6735875-0 |
---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: | Check_OutputDebugStringA_iat |
---|---|
TLP: | TLP:WHITE |
Repository: |
Rule name: | INDICATOR_EXE_Packed_Themida |
---|---|
Author: | ditekSHen |
Description: | Detects executables packed with Themida |
TLP: | TLP:WHITE |
Repository: | diˈtekSHən |
Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
---|---|
Author: | XiAnzheng |
Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | vmdetect |
---|---|
Author: | nex |
Description: | Possibly employs anti-virtualization techniques |
TLP: | TLP:WHITE |
Repository: |
Rule name: | Windows_Generic_Threat_7526f106 |
---|---|
Author: | Elastic Security |
TLP: | TLP:WHITE |
Repository: | elastic |
Rule name: | Windows_Generic_Threat_cbe3313a |
---|---|
Author: | Elastic Security |
TLP: | TLP:WHITE |
Repository: | elastic |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter