YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 28b17e29596b5f7f62089e40e2f56f35772d16923a33efc1baafff55b03cf4bc.

SHA256 hash:	28b17e29596b5f7f62089e40e2f56f35772d16923a33efc1baafff55b03cf4bc
File size:	544'768 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	a9b8ddac0f89157fdb7984dee6dbde7c
SHA1 hash:	ecc6bbde54844775dfb2e9472012116c5f9bc902
SHA3-384 hash:	ae721040dca4e0e005e7adefdbecbcad9a4b2e7292fad516367c3e71193dcaad8dfc706f6295f45a09989b6f3dd53b65
First seen:	2026-10-10 10:10:12 UTC
Last seen:	Never
Sightings:	1
imphash :	518e2567df5a710e1a04c448251c4580 Create hunting rule
ssdeep :	12288:6JpoXmkvVzi4Va26Cqsjmu2Jgz+bqKdCbuttR9R5/pHLfsa+l2lvPQDClz7wE:6JpopvV7pKn3NLf0l2lvPw
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MULTI_Malware_Unknown_ForgeAuto_57b77e4a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MULTI_Malware_Unknown_ForgeAuto_e38c53ae_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants
TLP:	TLP:WHITE
Repository:

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-10 10:10:12 UTC Static: 8 Unpacker: 0 ClamAV: 0