YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 340967a57845bb09b5570be64a0c64e1902380259552111330fcd4bdf0064ccd.

SHA256 hash:	340967a57845bb09b5570be64a0c64e1902380259552111330fcd4bdf0064ccd
File size:	3'552'256 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	02b2242d3c0e040043e0f1debfec3914
SHA1 hash:	85c8712366b647e3b396469885d048ad9343fbbd
SHA3-384 hash:	fe09b1bfd21dc34d90b32607b45e44f58ec5f2a5037f48d6f3dc0d9858561fc47e4310daec3854299b47ca42c1e3a749
First seen:	2025-11-21 18:59:08 UTC
Last seen:	Never
Sightings:	1
imphash :	6062d086cd85a066b46e181ac8ad540f Create hunting rule
ssdeep :	98304:7MeTUNgPfXPsLQEO6Gk49qXt9HG1Yc9X5t6DPx:wwfXPA8e49It9OLV5WPx
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Trojan.Packed2.49423-1.UNOFFICIAL Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	sus_pe_free_without_allocation Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects an executable importing functions to free memory without importing allocation functions, often indicative of dynamic import resolution
TLP:	TLP:WHITE

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-11-21 18:59:09 UTC Static: 3 Unpacker: 0 ClamAV: 1