YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 1210e36a88cfb035f2f30b2ab4ebbd63a2f488a3eff31080975fcbf9559d92a5.

Scan Results

SHA256 hash:	1210e36a88cfb035f2f30b2ab4ebbd63a2f488a3eff31080975fcbf9559d92a5
File size:	50'688 bytes
File download:	Original Unpacked
MIME type:	application/x-dosexec
MD5 hash:	1a477659d0bf2505ac9e52d6fbb18cff
SHA1 hash:	4798ec91c5fb75bc6afc7ff8a36239b9a5604fc5
SHA3-384 hash:	757575a3e5d41d20f500c8876f68ad0ffae7fddd1b86c3ffde515313f72c9879f3bfbf0905c586ddcff02019936f9911
First seen:	2026-10-10 10:16:09 UTC
Last seen:	2026-10-13 15:05:32 UTC
Sightings:	2
imphash :	f34d5f2d4577ed6d9ceec516c1f5a744 Create hunting rule
ssdeep :	384:WFrb51vIFF66z9S0huAozGYKg+9wFfYjid2+0xNcKKKKmI2hM6ZTSb7ROH9iUXFN:KrVZZ6zs0hjh17JqO/NaPzfX/fc04x
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	88e7d3e8-c717-11f1-b2b6-42010aa4000b
File name:	1a477659d0bf2505ac9e52d6fbb18cff
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

No matches

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Destructive_Ransomware_Gen1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects destructive malware
Reference:	http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Destructive_Ransomware_Gen1_RID31CB Create hunting rule
Author:	Florian Roth
Description:	Detects destructive malware
Reference:	http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
TLP:	TLP:WHITE

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	Detects command variations typically used by ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_imphash Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon
TLP:	TLP:WHITE
Repository:	SIFalcon

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_SHADOW_UNPACKED Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

Task Information

Task ID:	9d0d5b89-c493-11f1-b2b6-42010aa4000b
File name:	xoilac-tv.buzz_hyber.exe
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

No matches

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Destructive_Ransomware_Gen1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects destructive malware
Reference:	http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Destructive_Ransomware_Gen1_RID31CB Create hunting rule
Author:	Florian Roth
Description:	Detects destructive malware
Reference:	http://blog.talosintelligence.com/2018/02/olympic-destroyer.html
TLP:	TLP:WHITE

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	Detects command variations typically used by ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_imphash Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_VBS_Wscript_Shell Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon
TLP:	TLP:WHITE
Repository:	SIFalcon

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_SHADOW_UNPACKED Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

YARAify Scan Results

Scan Results Rescan

Tasks

2026-10-13 15:05:32 UTC Static: 22 Unpacker: 0 ClamAV: 0

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2026-10-10 10:16:09 UTC Static: 22 Unpacker: 0 ClamAV: 0

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

Scan Results