Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated. ➡️ Read here for more info

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 9fc9cd135efcbf0ff619b44254ede5ee30c6a3eb4182ce05e558b1032205d4f5.

Scan Results


SHA256 hash: 9fc9cd135efcbf0ff619b44254ede5ee30c6a3eb4182ce05e558b1032205d4f5
File size:10'973'641 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 585087ea46668e3cd9b895f731b1b904
SHA1 hash: 4cae73347ee32295d4ab57bff1e2feee613ba760
SHA3-384 hash: 045cb2d1cfa24ff06be7899d15b2ee9880868305b1bb3f4ae2dfd54624231afa6c88e414604aee98403edd48bc97b878
First seen:2025-08-24 22:17:19 UTC
Last seen:Never
Sightings:1
imphash : 65d901073a5036ac7bcde107346ff41f
ssdeep : 196608:zvVZpHGtoB86maXKWKY7xUJ9npFQZzyajfsHYlW:zvcwXKhd9npOZzyajfs4lW
TLSH : T19CB69E22B7D4852AE17363B05E6AF35BC2BDFA700AB1850F335C0A5F6DB51905EA1723
telfhash :n/a
gimphash :n/a
dhash icon : 00546c6c6c6c5400

Tasks


There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information


Task ID:199fcce6-8138-11f0-8fb7-42010aa4000b
File name:6d440000.mso40uiwin32client.dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BitcoinAddress
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:Check_OutputDebugStringA_iat
TLP:TLP:WHITE
Repository:
Rule name:CP_AllMal_Detector
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
TLP:TLP:WHITE
Repository:YARAify
Rule name:DebuggerCheck__API
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:golang_bin_JCorn_CSC846
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:pe_detect_tls_callbacks
Author:
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.