YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash a7bb8ce4623420fdd84d688fcb095b9438d81fd77e05d18796c93010ba772661.

Scan Results

SHA256 hash: a7bb8ce4623420fdd84d688fcb095b9438d81fd77e05d18796c93010ba772661
File size:5'984'641 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: fcffbdc659292cb52e7932a5dcd00f79
SHA1 hash: 5106b49ddf3fa9f5a01be781dc863f9f25213ab4
SHA3-384 hash: 207d939a97156ec334ce2d02e85baf6512aa239dd467013f403e04b0818dc6124b16fef345d578b9da633d2441da9ef3
First seen:2024-10-18 05:11:09 UTC
Last seen:Never
Sightings:1
imphash : c2736e101c4d71ef263aedfaa4a207e2
Create hunting rule
ssdeep : 98304:2WOc4ow9x+jfYIJ5lDtAB+i6D4CHp4DWnn6MNquKdCk4GUHXkI6qdsT8uLd:ROc4oyaJrDOB+ikH2qvqufk4GUHvDc
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

You can browse the 10 most recent tasks associated with this file blow.

Task Information

Task ID:63071b8c-8d0f-11ef-b6ec-42010aa4000b
File name:720a0000.mscorwks.dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
TLP:TLP:WHITE
Repository:
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
TLP:TLP:WHITE
Repository:
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
TLP:TLP:WHITE
Repository:
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.