Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated. ➡️ Read here for more info

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 1495432e75e19d7060bd1f51de57df369f2a1bbc14a9736269e695662ec3539c.

Scan Results


SHA256 hash: 1495432e75e19d7060bd1f51de57df369f2a1bbc14a9736269e695662ec3539c
File size:95'937 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 57262b805f1b2efae0f7183bbaef227b
SHA1 hash: e866fb03e3767b592d4c72d351c4f9faa43a0112
SHA3-384 hash: 415a155e353e07b65b47f3deb415cc74dfe9b7470cf3daa2b64c100c19263bd0de14fd9bf73c6b1846983cb09bd060c7
First seen:2025-08-24 22:15:11 UTC
Last seen:Never
Sightings:1
imphash : 3ddd3eae7776f9915345c5b61d702152
ssdeep : 1536:vICQCfd/UV2FyVw4zp6G5XKy1E6w8J52gw0JNqyFzWu9W5uyWZ0g2:v1t1E2FyVw4zINy1FxJ5y07qluM5A8
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 7474e8d4d4d4d4c8

Tasks


There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information


Task ID:cd361c26-8137-11f0-8fb7-42010aa4000b
File name:57262b805f1b2efae0f7183bbaef227b
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Asprotect-3
Signature:Win.Trojan.Farfli-9952113-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.