Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated. ➡️ Read here for more info

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 596949dccd9c7e6d34e3207e2ae246629f9e183f3a6caaedea43f944874c5ffc.

Scan Results

SHA256 hash: 596949dccd9c7e6d34e3207e2ae246629f9e183f3a6caaedea43f944874c5ffc
File size:53'819 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 7056def92dfbb55716f93f608f796f51
SHA1 hash: e40e1bb8b6c7127c2e1d7edb3976986464b6f3ec
SHA3-384 hash: b5088305b95e56c1e8bcbacbf3fb04439ea19990141ce4237e234cf74bda17c4a0e5b454491ad480fa01a18c8532a974
First seen:2025-08-24 22:17:29 UTC
Last seen:Never
Sightings:1
imphash : 871f566131c40f544851d687e3ef38f8
Create hunting rule
ssdeep : 768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1oj5n/wSkfwI:IzaEW5gMxZVXf8a3yO1opwAI
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 0000000000000000
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:1fca7222-8138-11f0-8fb7-42010aa4000b
File name:7056def92dfbb55716f93f608f796f51
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Chinaprotect-1
Create hunting rule
Signature:PUA.Win.Packer.SoftwareCompres-3
Create hunting rule
Signature:PUA.Win.Packer.SoftwareCompres-4
Create hunting rule
Signature:PUA.Win.Packer.SoftwareCompress-1
Create hunting rule
Signature:Win.Trojan.Baru-1
Create hunting rule
Signature:Win.Worm.Agent-1372178
Create hunting rule
Signature:Win.Worm.Agent-1372179
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:SoftwareCompressv14LITEBGSoftwareProtectTechnologies
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.