YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash c40f3117058d050091e8b90d0c85e618340a15d8f993b77433ad2f594e0599e4.

SHA256 hash:	c40f3117058d050091e8b90d0c85e618340a15d8f993b77433ad2f594e0599e4
File size:	282'624 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	68004f97bec3b1d431e008f9500476d1
SHA1 hash:	8764feb8a7d5a40c6c76668d14859041ef72952e
SHA3-384 hash:	3b9cfde94bb02f7ae9f951a3d5c254556b6c2d6d8085f1bc31489a8376153e2d664e39480ffbc4909e0c5dced100d0ec
First seen:	2025-12-13 13:46:32 UTC
Last seen:	Never
Sightings:	1
imphash :	511f40da8f63395723250169a02f003a Create hunting rule
ssdeep :	6144:i0HK58A8EpJbCRrZnC+S1O8CztkFdqPRdPk5ewfWQ:i958pnPS1O1tQd485NWQ
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	ba7afacacee6d6d2 Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	pe_detect_tls_callbacks Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-12-13 13:46:32 UTC Static: 5 Unpacker: 0 ClamAV: 0