YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 51053f30c20baa3918fb4a8dce5785de53dfa667c1c735881c40aeb8a95d7ca9
.
Scan Results
SHA256 hash: | 51053f30c20baa3918fb4a8dce5785de53dfa667c1c735881c40aeb8a95d7ca9 | |
---|---|---|
File size: | 106'496 bytes | |
File download: | Original | |
MIME type: | application/x-dosexec | |
MD5 hash: | e420cc9534b75d6df3e59e88f82814f9 | |
SHA1 hash: | 3aa8a82f4b3ca93c8421aad751a5335081a7edde | |
SHA3-384 hash: | 554aaa423ad27aa8ff8d6f201e367441317cfab6d9021b7f9b6053559ca2178fd6106959d49acc08efc865859929a9be | |
First seen: | 2025-10-03 03:18:42 UTC | |
Last seen: | 2025-10-03 03:24:02 UTC | |
Sightings: | 4 | |
imphash : | n/a | |
ssdeep : | 1536:IWqpM9EJq5SjI1La3Mg2L9uMb+KR0Nc8QsDYLnouy8wq3:KpMaICIRUMxJue0Nc8QssToutl | |
TLSH : | n/a | |
telfhash : | n/a | |
gimphash : | n/a | |
dhash icon : | n/a |
Tasks
There are 4 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
Task ID: | 68cfa1a8-a008-11f0-adeb-42010aa4000b | |
---|---|---|
File name: | 400000.10b3b161ce57d66ce8a4ff98040be5de.exe | |
Task parameters: | ClamAV scan: | True |
Unpack: | False | |
Share file: | True |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
Signature: | Win.Trojan.MSShellcode-6360728-0 |
---|
Signature: | Win.Trojan.MSShellcode-6360729-4 |
---|
Signature: | Win.Trojan.MSShellcode-6360730-0 |
---|
Signature: | Win.Trojan.Swrort-5710536-0 |
---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: | CP_AllMal_Detector |
---|---|
Author: | DiegoAnalytics |
Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | Hunting_Rule_ShikataGaNai |
---|---|
Author: | Steven Miller |
Reference: | https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html |
TLP: | TLP:WHITE |
Repository: | Neo23x0 |
Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | UPXv20MarkusLaszloReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | classified |
---|---|
Author: | classified |
Description: | classified |
TLP : | TLP:AMBER |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
Task ID: | 2100774f-a008-11f0-adeb-42010aa4000b | |
---|---|---|
File name: | 400000.10b3b161ce57d66ce8a4ff98040be5de.exe | |
Task parameters: | ClamAV scan: | True |
Unpack: | False | |
Share file: | True |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
Signature: | Win.Trojan.MSShellcode-6360728-0 |
---|
Signature: | Win.Trojan.MSShellcode-6360729-4 |
---|
Signature: | Win.Trojan.MSShellcode-6360730-0 |
---|
Signature: | Win.Trojan.Swrort-5710536-0 |
---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: | CP_AllMal_Detector |
---|---|
Author: | DiegoAnalytics |
Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | Hunting_Rule_ShikataGaNai |
---|---|
Author: | Steven Miller |
Reference: | https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html |
TLP: | TLP:WHITE |
Repository: | Neo23x0 |
Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | UPXv20MarkusLaszloReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | classified |
---|---|
Author: | classified |
Description: | classified |
TLP : | TLP:AMBER |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
Task ID: | da63e3ee-a007-11f0-adeb-42010aa4000b | |
---|---|---|
File name: | 400000.10b3b161ce57d66ce8a4ff98040be5de.exe | |
Task parameters: | ClamAV scan: | True |
Unpack: | False | |
Share file: | True |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
Signature: | Win.Trojan.MSShellcode-6360728-0 |
---|
Signature: | Win.Trojan.MSShellcode-6360729-4 |
---|
Signature: | Win.Trojan.MSShellcode-6360730-0 |
---|
Signature: | Win.Trojan.Swrort-5710536-0 |
---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: | CP_AllMal_Detector |
---|---|
Author: | DiegoAnalytics |
Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | Hunting_Rule_ShikataGaNai |
---|---|
Author: | Steven Miller |
Reference: | https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html |
TLP: | TLP:WHITE |
Repository: | Neo23x0 |
Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | UPXv20MarkusLaszloReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | classified |
---|---|
Author: | classified |
Description: | classified |
TLP : | TLP:AMBER |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.
Task Information
Task ID: | a9d78796-a007-11f0-adeb-42010aa4000b | |
---|---|---|
File name: | 400000.10b3b161ce57d66ce8a4ff98040be5de.exe | |
Task parameters: | ClamAV scan: | True |
Unpack: | False | |
Share file: | True |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
Signature: | Win.Trojan.MSShellcode-6360728-0 |
---|
Signature: | Win.Trojan.MSShellcode-6360729-4 |
---|
Signature: | Win.Trojan.MSShellcode-6360730-0 |
---|
Signature: | Win.Trojan.Swrort-5710536-0 |
---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
Rule name: | CP_AllMal_Detector |
---|---|
Author: | DiegoAnalytics |
Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
TLP: | TLP:WHITE |
Repository: | YARAify |
Rule name: | Hunting_Rule_ShikataGaNai |
---|---|
Author: | Steven Miller |
Reference: | https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html |
TLP: | TLP:WHITE |
Repository: | Neo23x0 |
Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | UPXv20MarkusLaszloReiser |
---|---|
Author: | malware-lu |
TLP: | TLP:WHITE |
Repository: |
Rule name: | classified |
---|---|
Author: | classified |
Description: | classified |
TLP : | TLP:AMBER |
Unpacker
The following YARA rules matched on the unpacked file.
Unpacked Files
The following files could be unpacked from this sample.