Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated. ➡️ Read here for more info

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash c62b0e252e75c46c0c7cb554fa4c9be8439069c28875686e911a8da258a8f6f7.

Scan Results


SHA256 hash: c62b0e252e75c46c0c7cb554fa4c9be8439069c28875686e911a8da258a8f6f7
File size:39'116 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: c2c9f76517e76aebb0a09e2fe11c8911
SHA1 hash: 1f58ca5f86e2eec70c18def0b96422645eaeafb8
SHA3-384 hash: 73e183cfdbde7bc69059589fe67432bea4e0ae6e8b9a76b689f61633d8d2e5459a472d21ccb531e0d21f28b2eda6a026
First seen:2025-08-24 22:21:21 UTC
Last seen:Never
Sightings:1
imphash : 3b884b93be1eaa99038bd3acaaa5f577
ssdeep : 768:OqPJtYA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EwhSahGCo1:Oq4A6C1VqaqhtgVRNToV7TtRu8rM0wYP
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information


Task ID:aa10dc38-8138-11f0-8fb7-42010aa4000b
File name:c2c9f76517e76aebb0a09e2fe11c8911
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.7cbdf52c-10004103-0
Signature:Win.Malware.80bbf3f-10029182-0
Signature:Win.Malware.E1ead-10029202-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CP_AllMal_Detector
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
TLP:TLP:WHITE
Repository:YARAify
Rule name:FreddyBearDropper
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:NET
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.