YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 91cb541c151593fb6237f3dd55981c7c4ad79c7b010577d2174e92949c18b494.

SHA256 hash:	91cb541c151593fb6237f3dd55981c7c4ad79c7b010577d2174e92949c18b494
File size:	2'791'776 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	0ed6819f3cc26671ad0f28e4f987d013
SHA1 hash:	af3e823d67178379048819056dd74d5339931af3
SHA3-384 hash:	b28f1066976b42b1d27b2d25bb7fc92408e229aa8cccfe1d0fe9d6be5d9c27bb0633a7752272c29806e01b586872f1ef
First seen:	2025-11-21 19:02:47 UTC
Last seen:	Never
Sightings:	1
imphash :	afcdf79be1557326c854b6e20cb900a7 Create hunting rule
ssdeep :	49152:WTLwQP4sfXS/a6zPp4NE88c2TL8HoBW0VOnNfo4hDc+J+Hl1KH0PHQ2R4avMX:6LJNfXSFzPp4NE88c2TgHyb0NzhDcyKK
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	f0ccae92d0d8e882 Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-11-21 19:02:47 UTC Static: 6 Unpacker: 0 ClamAV: 0