YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash a8f80b2d6000947c33e42e65d4f5a6d9e73d5524abdfd0b52f91903afa05ec1f.

SHA256 hash:	a8f80b2d6000947c33e42e65d4f5a6d9e73d5524abdfd0b52f91903afa05ec1f
File size:	1'215'488 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	e82562148459b5dfb92287c8816c582c
SHA1 hash:	1c126b47a67d1e5ddeea7cb4970bc657fcc3f1de
SHA3-384 hash:	8deae0a06fd1f3a8d82b2b33caacbbf9e5b21a77658a18b27be67f8a07cbebe86bf1de29416906bb06387242e3d0f2d0
First seen:	2025-05-13 22:23:58 UTC
Last seen:	Never
Sightings:	1
imphash :	181169162fb5f2667bac6114159c9f3c Create hunting rule
ssdeep :	24576:TME/oAONd2NJ48QVwGe+ip6BJ9baj/hT5n+nu6D33fHWKA0n9om3bmXVjL+mEA6:YE/oAOHk48AQpmVaj/hT5nMuaTo681+
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	04c988cce6fc7012 Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Win32.Expiro-3.UNOFFICIAL Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	Check_OutputDebugStringA_iat Create hunting rule
TLP:	TLP:WHITE
Repository:

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-05-13 22:24:00 UTC Static: 3 Unpacker: 0 ClamAV: 1