YARAify Scan Results

Task Information

---

Task ID:	de3fa81e-8137-11f0-8fb7-42010aa4000b
File name:	9e1219df44f36884c1549cb4813ce099
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	MiscreantPunch.EvilMacro.PVDISABLE.170819.UNOFFICIAL Alert Create hunting rule

Signature:	TwinWave.EvilDoc.HanciInterruptMyDayHandler.20210721.UNOFFICIAL Alert Create hunting rule

Signature:	TwinWave.EvilDoc.PKILLDropboxMacroDirectDownload.20220331.UNOFFICIAL Alert Create hunting rule

Signature:	TwinWave.EvilDoc.PolicyKillOnlyHappyWhenItRains.20210704.UNOFFICIAL Alert Create hunting rule

Signature:	Win.Dropper.Nanocore-10030076-0 Alert Create hunting rule

Signature:	Win.Dropper.njRAT-10015886-0 Alert Create hunting rule

Signature:	Win.Packed.Bladabindi-6917466-0 Alert Create hunting rule

Signature:	Win.Packed.Generic-9795615-0 Alert Create hunting rule

Signature:	Win.Packed.Generic-9795616-0 Alert Create hunting rule

Signature:	Win.Trojan.B-468 Alert Create hunting rule

Signature:	Win.Trojan.Bladabindi-6192388-0 Alert Create hunting rule

Signature:	Win.Trojan.Generic-6417450-0 Alert Create hunting rule

Signature:	Win.Trojan.Generic-6454614-0 Alert Create hunting rule

Signature:	Win.Trojan.Generic-6454615-0 Alert Create hunting rule

Signature:	Win.Trojan.Shiz-2273 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_AllMal_Detector Alert Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Disable_Defender Alert Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	INDICATOR_SUSPICIOUS_EXE_Enable_OfficeMacro Alert Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing Office macro registry keys. Observed modifying Office configurations via the registy to enable macros
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	Lumma Alert Create hunting rule
Author:	kevoreilly
Description:	Lumma Payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	MAL_njrat Alert Create hunting rule
Author:	SECUINFRA Falcon Team
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	malware_Njrat_strings Alert Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect njRAT in memory
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MALWARE_Win_NjRAT Alert Create hunting rule
Author:	ditekSHen
Description:	Detects NjRAT / Bladabindi / NjRAT Golden
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	NETexecutableMicrosoft Alert Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	Njrat Alert Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat
TLP:	TLP:WHITE
Repository:

Rule name:	Njrat Alert Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect njRAT in memory
TLP:	TLP:WHITE
Repository:

Rule name:	njrat_ Alert Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked njrat malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PE_Digital_Certificate Alert Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE
Repository:

Rule name:	RIPEMD160_Constants Alert Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants
TLP:	TLP:WHITE
Repository:

Rule name:	SHA1_Constants Alert Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants
TLP:	TLP:WHITE
Repository:

Rule name:	Skystars_LightDefender_Njrat_Rule Alert Create hunting rule
Author:	Skystars LightDefender
Description:	Detects Njrat
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Sus_CMD_Powershell_Usage Alert Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Alert Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	vbaproject_bin Alert Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	win_lumma_auto Alert Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.lumma.
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	classified
Author:	classified
TLP :	TLP:GREEN

Rule name:	win_njrat_w1 Alert Create hunting rule
Author:	Brian Wallace @botnet_hunter <bwall@ballastsecurity.net>
Description:	Identify njRat
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	Windows_Trojan_Lumma_4ad749b0 Alert Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Njrat_30f3c220 Alert Create hunting rule
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Njrat_30f3c220 Alert Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.