NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash db7354c1824615450b8ad402d5ca7616546954cba3dd5a8d3253b79626a385fe.

Scan Results

SHA256 hash: db7354c1824615450b8ad402d5ca7616546954cba3dd5a8d3253b79626a385fe
File size:327'822 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: f1502200cf956ed295979fc1132c4c9d
SHA1 hash: fb19b0c8718c15f9969e72a755d370f106d594fd
SHA3-384 hash: 03413125d72f83fe4de1edf3bed10d6a8c1401e4ff2edbfbd5d459c1f66cfd16f763fe8fcf76cf7b46636dab0dd62d92
First seen:2024-11-04 16:51:44 UTC
Last seen:2024-11-04 16:51:45 UTC
Sightings:2
imphash : 57347122b3d27cdc343ec66243ce5f8f
Create hunting rule
ssdeep : 3072:MUkLgx3kgHYkqORLsSWjLtj37ivngErAkh8x3kgHYkqORLsSHjCT:MUWgQjLtj37MngErAo8pji
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : b170e4ccccf071b2
Create hunting rule

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:13238ffc-9acd-11ef-b6ec-42010aa4000b
File name:400000.5a19a865-c8c8-4d61-8912-445e0c0d0e03.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Mpress-5
Create hunting rule
Signature:Win.Keylogger.Dynamer-9867084-0
Create hunting rule
Signature:Win.Packed.Conjar-9761614-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:TeslaCryptPackedMalware
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.

Task Information

Task ID:1373f21a-9acd-11ef-b6ec-42010aa4000b
File name:400000.5a19a865-c8c8-4d61-8912-445e0c0d0e03.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Mpress-5
Create hunting rule
Signature:Win.Keylogger.Dynamer-9867084-0
Create hunting rule
Signature:Win.Packed.Conjar-9761614-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:TeslaCryptPackedMalware
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.