YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 6d09601ca7422e66f3f30ca1626f5ba2b69e7e4b0549cbb020b6e1f8dfed02f0.

Scan Results

SHA256 hash: 6d09601ca7422e66f3f30ca1626f5ba2b69e7e4b0549cbb020b6e1f8dfed02f0
File size:405'504 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: a5f0955668d4929694cc2019f623caa6
SHA1 hash: a49573c942723a6acc873a7c555c07cd53b48326
SHA3-384 hash: 2574de9021e5c619f670eb25a96701221ff503bd125fbcb1ebe994fd7172ee7a49abae5791a758abf831357f68800483
First seen:2024-10-18 05:12:53 UTC
Last seen:2024-10-18 05:12:54 UTC
Sightings:2
imphash : be933ffe7752ff40fd9716b867d3ba5a
Create hunting rule
ssdeep : 12288:isaNDuawNB6VMhWO/b0XWR7hW2DPvq69nuTZSxr0dBgQ3:isaNDNwNBsQWcImRE2Lh9nulSxr08M
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

You can browse the 10 most recent tasks associated with this file blow.

Task Information

Task ID:a133b8a2-8d0f-11ef-b6ec-42010aa4000b
File name:400000.556b3986-42df-4d1e-baae-f60686669b49.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Borland
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.

Task Information

Task ID:a1654ff3-8d0f-11ef-b6ec-42010aa4000b
File name:400000.556b3986-42df-4d1e-baae-f60686669b49.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Borland
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.