YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash f354dec52d4a7ecdce26e41d8d24594115ae006fa9265e8ffac64837c1506034
.
Scan Results
SHA256 hash: | f354dec52d4a7ecdce26e41d8d24594115ae006fa9265e8ffac64837c1506034 | |
---|---|---|
File size: | 1'069'124 bytes | |
File download: | Original | |
MIME type: | application/x-dosexec | |
MD5 hash: | 979084acf15f42fd1310e5ded9fcc05c | |
SHA1 hash: | 016bd229554370072ffe196e36baaf9003fcded5 | |
SHA3-384 hash: | 37b2fd133bba91a512d63ebdac811b4f910f8d8d659dd43fb66c8561cbf9a0344b5a749495f4c3887ac7314261591d53 | |
First seen: | 2025-08-24 22:20:16 UTC | |
Last seen: | Never | |
Sightings: | 1 | |
imphash : | 722bae98b5cb0adc34de86ef8126aa8e | |
ssdeep : | 12288:NwiYQQVQRlHB8kLVThcECt1wiYQQVQRlHB8kLVTht8DAVp:NwQQVQRlB8kRTqjt1wQQVQRlB8kRTlVp | |
TLSH : | n/a | |
telfhash : | n/a | |
gimphash : | n/a | |
dhash icon : | n/a |
Tasks
There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
Task ID: | 830787b4-8138-11f0-8fb7-42010aa4000b | |
---|---|---|
File name: | 979084acf15f42fd1310e5ded9fcc05c | |
Task parameters: | ClamAV scan: | True |
Unpack: | False | |
Share file: | True |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
Signature: | PUA.Win.Packer.Aspack-29 |
---|
Signature: | PUA.Win.Packer.Aspack-30 |
---|
Signature: | PUA.Win.Packer.Asprotect-3 |
---|
Signature: | SecuriteInfo.com.Trojan.GenericKD.36051471.21356.3931.UNOFFICIAL |
---|
Signature: | Win.Ransomware.Azvo-9978000-0 |
---|
Signature: | Win.Trojan.Bulz-9939729-0 |
---|
Signature: | Win.Trojan.Disbi-1 |
---|
Signature: | Win.Worm.Pajetbin-6726648-0 |
---|
Signature: | Win.Worm.Vindor-9886047-0 |
---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: | CP_AllMal_Detector |
---|---|
Author: | DiegoAnalytics |
Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | DebuggerCheck__API |
---|---|
Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
TLP: | TLP:WHITE |
Rule name: | DebuggerHiding__Thread |
---|---|
Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
TLP: | TLP:WHITE |
Rule name: | dgaagas |
---|---|
Author: | Harshit |
Description: | Uses certutil.exe to download a file named test.txt |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | golang_bin_JCorn_CSC846 |
---|---|
Author: | Justin Cornwell |
Description: | CSC-846 Golang detection ruleset |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | INDICATOR_KB_CERT_0c5396dcb2949c70fac48ab08a07338e |
---|---|
Author: | ditekSHen |
Description: | Detects executables signed with stolen, revoked or invalid certificate |
TLP: | TLP:WHITE |
Repository: | diˈtekSHən |
Rule name: | pe_detect_tls_callbacks |
---|---|
Author: | |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | PE_Digital_Certificate |
---|---|
Author: | albertzsigovits |
TLP: | TLP:WHITE |
Repository: |
Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
---|---|
Author: | XiAnzheng |
Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
TLP: | TLP:WHITE |
Repository: | YARAify |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter