YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 2783fbe89989498e949a042b3690566c1321ecb75ee2d69d0d8bcb5ce169a45b.

SHA256 hash:	2783fbe89989498e949a042b3690566c1321ecb75ee2d69d0d8bcb5ce169a45b
File size:	11'776 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	0da46ab949b21c79c070bfa4d1fa7b28
SHA1 hash:	e53d9a182ab50680035bb027e3d6fdd3e1fb9341
SHA3-384 hash:	2eeb0e80934fa0d2e48efdfe4d8fea9a87b9c22d60b239042c51a2880255ea334187dc20b776f1da3bf9190529b8972d
First seen:	2025-11-21 18:58:24 UTC
Last seen:	Never
Sightings:	1
imphash :	8ea30d5a22b678544128f16518dc435c Create hunting rule
ssdeep :	96:NgvXu4b7qXUlTxeWPfuFfbJIrqWgYxAwRzJrqlG0/LBJzJm73Q5tfdSE5SnmWCq5:NFa7S2AqJxV2G0dS3Q5tfdL55WhUj9
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Trojan.MSShellcode-6 Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	CobaltStrike__Resources_Reverse64_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com
TLP:	TLP:WHITE
Repository:	GCTI

Rule name:	CobaltStrike_Resources_Reverse64_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	metasploit_rev_tcp_64 Create hunting rule
Author:	Javier Rascon
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Description:	classified

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function leverage by metasploit shellcode
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_91bc5d7d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
TLP:	TLP:WHITE
Repository:	elastic

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-11-21 18:58:24 UTC Static: 10 Unpacker: 0 ClamAV: 1