YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 39504dc4e8e830014734d8135cf48d10bfbe8f7cba83ac632acc292ffd6b8ff2.

Scan Results

SHA256 hash: 39504dc4e8e830014734d8135cf48d10bfbe8f7cba83ac632acc292ffd6b8ff2
File size:1'306'624 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 010f704267d864690ad0b63c0a44113d
SHA1 hash: c5a6eae028f9e474e6228278fd0dc04d2dd8680d
SHA3-384 hash: b99740d05cb12809da9c28df19afb04dfa3f84f2f1ec753ff49884ce910ffb5c6f61e2d3be1918410b7120c99b90058c
First seen:2025-11-21 19:00:12 UTC
Last seen:Never
Sightings:1
imphash : bc7429c21973649e822dbec2b14ff39c
Create hunting rule
ssdeep : 12288:tr4uToQpe8rZVeqZqhb8wjRahN7F4r+4yykuvjar/IqqY:trHToQ8oVeqZqhwS/blvur/f
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:4eafc978-c70c-11f0-a73e-42010aa4000b
File name:010f704267d864690ad0b63c0a44113d
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Win32.Expiro-2.UNOFFICIAL
Create hunting rule
Signature:Win.Ransomware.Gandcrab-10058338-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.