YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 29b079a47c1ab01134a8ccf141c1c6dd12b114ae15325a5172e186dfa1388a71.

Scan Results

SHA256 hash: 29b079a47c1ab01134a8ccf141c1c6dd12b114ae15325a5172e186dfa1388a71
File size:4'256'913 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 0d2398c32071aa99aa48261609a678c9
SHA1 hash: cee25dc0028c0dc5e06691228bb8d9766ba1d03d
SHA3-384 hash: 83469db4636d268de124e828501f73c5dc4550cb7ec83d73f6bc8589c7c5156e12d83665158f583f8b946e4f67c8cf54
First seen:2026-04-12 16:58:50 UTC
Last seen:Never
Sightings:1
imphash : 65b6862e9898b195f4ef7a1685fd82dd
Create hunting rule
ssdeep : 12288:uFZOCMdgQ3Fw0iAIapdt0GenVPYD08x1XX46fTVpPn4kHKJO3JO:uFZRMuey1AfVeVPBUlX3fTV9n4kBA
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:e1791dd4-3690-11f1-bfeb-42010aa4000b
File name:0d2398c32071aa99aa48261609a678c9
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Sivis-6750888-0
Create hunting rule
Signature:Win.Malware.Sivis-6759080-0
Create hunting rule
Signature:Win.Malware.Sivis-6838247-0
Create hunting rule
Signature:Win.Packed.Generickdz-10012658-0
Create hunting rule
Signature:Win.Virus.VMProtBad-6450060-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:mpress_2_xx_x86
Create hunting rule
Author:Kevin Falcoz
Description:MPRESS v2.XX x86 - no .NET
TLP:TLP:WHITE
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:RAT_Sakula
Create hunting rule
Author:Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings
Description:Detects Sakula v1.0 RAT
Reference:http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:TeslaCryptPackedMalware
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.