YARAify Scan Results

Task Information

---

Task ID:	1ebbf451-7243-11ef-b6ec-42010aa4000b
File name:	d9735f050a653da9501b368cdd5d7513
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	PUA.Win.Adware.Amonetize-7134978-0 Alert Create hunting rule

Signature:	PUA.Win.Adware.Amonetize-7170432-0 Alert Create hunting rule

Signature:	PUA.Win.Adware.Amonetize-7171980-0 Alert Create hunting rule

Signature:	PUA.Win.Adware.Amonetize-8478999-0 Alert Create hunting rule

Signature:	SecuriteInfo.com.Adware.BundleApp.IDV.UNOFFICIAL Alert Create hunting rule

Signature:	SecuriteInfo.com.Adware.BundleApp.ILO.UNOFFICIAL Alert Create hunting rule

Signature:	Win.Packed.Zusy-9837875-0 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_APT29_WINELOADER_Backdoor Alert Create hunting rule
Author:	daniyyell
Description:	Detects APT29's WINELOADER backdoor variant used in phishing campaigns, this rule also detect bad pdf,shtml,htm and vbs or maybe more depends
Reference:	https://cloud.google.com/blog/topics/threat-intelligence/apt29-wineloader-german-political-parties
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PE_Digital_Certificate Alert Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE
Repository:

Rule name:	PE_Potentially_Signed_Digital_Certificate Alert Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.