YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 259f5f17de9f4e111ca8a2b2de4e4f45ec7e5bbf07e8c70e96133997f4a56356.

Scan Results

SHA256 hash: 259f5f17de9f4e111ca8a2b2de4e4f45ec7e5bbf07e8c70e96133997f4a56356
File size:322'512 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 17cf58b2db58d1d7ca9ffc01d07692a6
SHA1 hash: 4735370a7683fe33748b4ee664f8643ab0bb0447
SHA3-384 hash: 1472204ec2ad74eb2c3a593366ed095580847d52f36bd6b98c77a9595524de2efa0d0031ba9143867c078072ff70a5eb
First seen:2025-11-21 19:00:47 UTC
Last seen:Never
Sightings:1
imphash : a8286b574ff850cd002ea6282d15aa40
Create hunting rule
ssdeep : 6144:1rYbUzkuvcBYC47l2xa6g4FhwjZd/9d1XKxlo/ecwrHs53:1rdkuveY36kjZP/XKxlSZAHS
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 92e0a496a2cada72
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:638664a8-c70c-11f0-a73e-42010aa4000b
File name:17cf58b2db58d1d7ca9ffc01d07692a6
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.InstallRex-1.UNOFFICIAL
Create hunting rule
Signature:Win.Adware.Agent-1388696
Create hunting rule
Signature:Win.Adware.Agent-1388697
Create hunting rule
Signature:Win.Trojan.Antifw-122
Create hunting rule
Signature:Win.Trojan.Antifw-123
Create hunting rule
Signature:Win.Trojan.Antifw-173
Create hunting rule
Signature:Win.Trojan.Antifw-8
Create hunting rule
Signature:Win.Trojan.Installerex-249
Create hunting rule
Signature:Win.Trojan.Installerex-250
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
TLP:TLP:WHITE
Repository:
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
TLP:TLP:WHITE
Repository:
Rule name:PUP_InstallRex_AntiFWb
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Malware InstallRex / AntiFW
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
TLP:TLP:WHITE
Repository:Neo23x0

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.