YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 4e47a62f359fa1f91188763ab400bbba31e277b03a7831d2e6f7618e5a754283.

Scan Results

SHA256 hash: 4e47a62f359fa1f91188763ab400bbba31e277b03a7831d2e6f7618e5a754283
File size:38'400 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 12a30b57448b9198cccfafe901bc3c30
SHA1 hash: 145736c28425eedf6113bde9231ee9bfb4b14169
SHA3-384 hash: 10bdf238e37a5e77e4fc0dc2c6ba651bd3d01b915a4efa999e844f6b2a7510584e0fa56972e298baae08fe2bc59b8d49
First seen:2025-12-13 13:46:28 UTC
Last seen:Never
Sightings:1
imphash : a9aa082c10abd520d825a8ef0f67458c
Create hunting rule
ssdeep : 384:xrOl5wfW/cEEwlHAnt9n5DvAD+c4iwPQVuawl3ZKO2tZXdRo1ZJ4H1X98G7rh8Z3:swfugt9S45kJHpiSrh8ZZgb
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:1fe8ac88-d82a-11f0-9df4-42010aa4000b
File name:744f0000.dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.