YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash faa354711d9ac4503e7ee943bbc7787cdf2c3e36477731753064fc42df3953f7.

SHA256 hash:	faa354711d9ac4503e7ee943bbc7787cdf2c3e36477731753064fc42df3953f7
File size:	1'547'125 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	69907575eee6ecb34dfae9c7b1007bce
SHA1 hash:	27a273ae77484dd0065ce68b430a0bdcfeacfc86
SHA3-384 hash:	cef59ee3c8e2a188bfe437920d0b9f75e039b1e6ceb4640dfb9d134f6fdc2006f719c70a6d790bdb5a1c801896b235d7
First seen:	2025-08-24 22:17:25 UTC
Last seen:	Never
Sightings:	1
imphash :	2c43cda2243b5af72e180e8d1f09446d Create hunting rule
ssdeep :	24576:vFrRoNk7BZpkfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLe9rJkQx4tUjS4bQO:NrRokpk/4MnYYJ2ZhqSGLHkJEM6IgjdT
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
TLP:	TLP:WHITE

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE
Repository:

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-08-24 22:17:25 UTC Static: 8 Unpacker: 0 ClamAV: 0