YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 690457cb46015ddd04e11be7e07594cbec48c3d92e846068d6f91d1836311d89.

Scan Results

SHA256 hash: 690457cb46015ddd04e11be7e07594cbec48c3d92e846068d6f91d1836311d89
File size:1'172'225 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: bd99c9bef994cc3a25584e5554480f73
SHA1 hash: 39406471b8258c6a712ae36cb539507f31935c04
SHA3-384 hash: 0c73d9cffaf46282a34efe47596904b37968d9cd64eed5f62e9fbfe9dcb8169e4faf633858ec3fa4a271f83a62db16f6
First seen:2024-10-18 05:12:21 UTC
Last seen:2024-10-18 05:12:21 UTC
Sightings:2
imphash : 242e8815005c0461e19540d9ecdf88ea
Create hunting rule
ssdeep : 24576:qFceY2hYf8tcPgSRj1+5gjBaV38q1kyqnxgTF5wZ9FTeIwJpEI1sa:qF3YENQj62BaX1+e/wZ9FTVwb
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 686e74e6c2e8e4e0
Create hunting rule

Tasks

You can browse the 10 most recent tasks associated with this file blow.

Task Information

Task ID:8da708d7-8d0f-11ef-b6ec-42010aa4000b
File name:400000.4b493bc5-5472-4d40-8fc0-7fe54bfd97b2.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Adware.Generic4.BQBH.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Borland
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:TLP:RED
Repository:YARAify
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.

Task Information

Task ID:8dc7948b-8d0f-11ef-b6ec-42010aa4000b
File name:400000.4b493bc5-5472-4d40-8fc0-7fe54bfd97b2.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Adware.Generic4.BQBH.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Borland
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:TLP:RED
Repository:YARAify
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.