YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash b4320fcb941a0a8183d2dbdfa17487b5401a25e4d79536fa63d89795153f68e4.

SHA256 hash:	b4320fcb941a0a8183d2dbdfa17487b5401a25e4d79536fa63d89795153f68e4
File size:	8'951 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	d69b68ea155665c84794695de486d059
SHA1 hash:	c3821af294f714adf4936cbc4562332a07f63fad
SHA3-384 hash:	236db23bab00863bcc5638bd0c147b8263221700327048d1f6b055c565d8bcdc541540e418779a3bbbecea3229562d06
First seen:	2025-04-03 02:32:13 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	192:Evh0V+b+S/I8As+WqyEkxGViLiJ/mzpsd:kU+6S/I8x4re4/gK
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Downloader.Bublik-9811703-0 Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	pe_no_import_table Create hunting rule
Author:
Description:	Detect pe file that no import table
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-04-03 02:32:13 UTC Static: 3 Unpacker: 0 ClamAV: 1