YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash b78d95fa8d9c599aac646c90b4238af9380cebd97166cf042fe5ab333442f0eb.

Scan Results

SHA256 hash: b78d95fa8d9c599aac646c90b4238af9380cebd97166cf042fe5ab333442f0eb
File size:4'662'272 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 0856e79fbc4f9246976b025cb5ee862f
SHA1 hash: 597497d6704940156b23f59dfc1691950453316a
SHA3-384 hash: f5c89c7c166c4b8be883f4162d9a7d62827e734e69b9ddaf283eae23a20b5dc8801a7a903f8a4b5fb0b98066c4fe13ed
First seen:2025-11-21 19:01:42 UTC
Last seen:Never
Sightings:1
imphash : bc5ce9212a98c781316c39a0a5c45ffb
Create hunting rule
ssdeep : 49152:zENwzIR257BkIqR6FoRvku04YLEENwzIR257BLIqR6FoRvku04YL92jW46yv:zgwkQ7+IqMe5gwkQ7tIqMe
TLSH : T198265C10B7908028FAF352F55ABDE178A5297CF04B6890CFA1D576FE4A366E02D32357
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon : 818da080a0a0a0a2
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:845671c6-c70c-11f0-a73e-42010aa4000b
File name:0856e79fbc4f9246976b025cb5ee862f
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.PWS.Gamania.46976.UNOFFICIAL
Create hunting rule
Signature:Win.Malware.Agen-10058411-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
TLP:TLP:WHITE
Repository:
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.