NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 5a577f4970da32b569eb3ec397447c009a4107099dc1de456d3d31ee252fb8a8.

Scan Results

SHA256 hash: 5a577f4970da32b569eb3ec397447c009a4107099dc1de456d3d31ee252fb8a8
File size:2'273'280 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 48999aa3f4a102eefe2237fa3d15405a
SHA1 hash: 35b4e44cc3dcda1135ceb57eab4e85fca3c4d35d
SHA3-384 hash: 90274d9162b65befb2aaf324947f9aaea2191595bc87e462186de43adf27f74b38febf6eeb127d37a0f4533974734a0d
First seen:2024-09-24 10:12:11 UTC
Last seen:Never
Sightings:1
imphash : 6a1717be06562c515df636dcd6a392be
Create hunting rule
ssdeep : 24576:kE4V5M8Mglj+9/TW0gleLuEoPGJzuSlQY2xOVDxQzlAS5v5a10:kEw5W9i0geCEoPGtQY2xOVCJAS5Ba10
TLSH : T1ECB55B0277D080B2C1E2317929692768E3AB9E2027F444CFB74D2A9B6F7F6C79538355
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:77105182-7a5d-11ef-b6ec-42010aa4000b
File name:48999aa3f4a102eefe2237fa3d15405a
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Adware.AdInstaller.FunWeb.9360.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.Adware.AdInstaller.FunWeb.9569.UNOFFICIAL
Create hunting rule
Signature:Win.Adware.Funweb-3
Create hunting rule
Signature:Win.Adware.Myway-5
Create hunting rule
Signature:Win.Trojan.Delf-31731
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:TLP:WHITE
Repository:YARAify
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:TLP:WHITE
Repository:YARAify
Rule name:Quarian
Create hunting rule
Author:Seth Hardy
Description:Quarian
TLP:TLP:WHITE
Rule name:QuarianCode
Create hunting rule
Author:Seth Hardy
Description:Quarian code features
TLP:TLP:WHITE
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
TLP:TLP:WHITE
Repository:
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
TLP:TLP:WHITE
Repository:
Rule name:win_sinowal_w1
Create hunting rule
Author:Seth Hardy
Description:Quarian code features
TLP:TLP:WHITE
Repository:Malpedia

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.