YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 5b7d468f5f78b8425175039b8bbdf2a5c3c362cd4009975cc18dfd624e4e8611.

SHA256 hash:	5b7d468f5f78b8425175039b8bbdf2a5c3c362cd4009975cc18dfd624e4e8611
File size:	24'576 bytes
File download:	Original
MIME type:	application/octet-stream
MD5 hash:	2f29f724b630b0bf2f9b16e2b05e8bc9
SHA1 hash:	197538c25e96c7998032f7d67c2c614f67ea25af
SHA3-384 hash:	8aae0ae6c774068d92b8e88c6578dc9961eee7e92221a870d27e55c93d59ed0493e04e4757042b4ad99f074d03e96558
First seen:	2025-04-03 02:32:33 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	384:2duOL+WTqX9JX5NpK+dhRPzhCepLlsESzSzVWdqFqfz5g+Kz:xOKWTIJXk+zpzhhFlycFqfz
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	aPLib_decompression Create hunting rule
Author:	@r3c0nst
Description:	Detects aPLib decompression code often used in malware
Reference:	https://ibsensoftware.com/files/aPLib-1.1.1.zip
TLP:	TLP:WHITE
Repository:	fboldewin

Rule name:	win_tinba_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.tinba.
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_tinba_w0 Create hunting rule
Author:	n3sfox <n3sfox@gmail.com>
Description:	Tinba 2 (DGA) banking trojan
Reference:	https://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world
TLP:	TLP:WHITE
Repository:	Malpedia

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-04-03 02:32:33 UTC Static: 5 Unpacker: 0 ClamAV: 0