NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 4c9781cb0b94ed2d92e529745476ad6582b35be7a3fd328c2a26df92a0952c58.

Scan Results

SHA256 hash: 4c9781cb0b94ed2d92e529745476ad6582b35be7a3fd328c2a26df92a0952c58
File size:315'178 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: ea8b8f7c4f332d307b4cfce74e07be99
SHA1 hash: 414cc703aa10ba1f5bedc5b57c45847872ef35cc
SHA3-384 hash: a6accc5325d26637181dcade98a8ce2745da0ff3b01f6ef840c79d400d504a970cb80170ced5d55dd8d5b1ed50830051
First seen:2025-05-03 03:28:40 UTC
Last seen:Never
Sightings:1
imphash : 9c523d8653da5455667e3f82274f2f88
Create hunting rule
ssdeep : 6144:k8rlmtPUNmSyBryBJN98DrU8VWRCITZwvMEW+xgtJRioCYz+qPJkCt:NlmtMo0Bz9iY8VWRCeZuvW+x9oLn
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : b2a89c96a2cada72
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:b5a1aff7-27ce-11f0-81bc-42010aa4000b
File name:ea8b8f7c4f332d307b4cfce74e07be99
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Adware.Hotbar-9753192-0
Create hunting rule
Signature:PUA.Win.Adware.Hotbar-9792239-0
Create hunting rule
Signature:PUA.Win.Adware.Hotbar-9793028-0
Create hunting rule
Signature:PUA.Win.Adware.Hotbar-9793192-0
Create hunting rule
Signature:PUA.Win.Adware.Hotbar-9793193-0
Create hunting rule
Signature:PUA.Win.Adware.Hotbar-9799004-0
Create hunting rule
Signature:PUA.Win.Adware.Hotbar-9806503-0
Create hunting rule
Signature:PUA.Win.Adware.Swiftcleaner-9792311-0
Create hunting rule
Signature:SecuriteInfo.com.Adware.Heur.cu1@RGhMuKbi.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.Win32.Malware_gen.10815.UNOFFICIAL
Create hunting rule
Signature:Win.Adware.Agent-231118
Create hunting rule
Signature:Win.Adware.Agent-745443
Create hunting rule
Signature:Win.Adware.Hotbar-4783
Create hunting rule
Signature:Win.Adware.Hotbar-50
Create hunting rule
Signature:Win.Trojan.Adinstall-2
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.