YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 31a6a4fb4dcbd9fdd1b69eee46448bb70c107891a291fa7bf1dda0d6f4da128c.

Scan Results

SHA256 hash: 31a6a4fb4dcbd9fdd1b69eee46448bb70c107891a291fa7bf1dda0d6f4da128c
File size:77'216 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 38d6de02d323903df812200a7fba002f
SHA1 hash: 440d4d7a2101a222db60eea718cbf02f84c315d6
SHA3-384 hash: e5d38cbd37f268239b36f19f413963c6899110bd77608d552def471a0dd64f6a416ff2351b4330d384f6c0fc55c71323
First seen:2025-11-21 02:56:56 UTC
Last seen:Never
Sightings:1
imphash : 1d6d3ae4b7139a0fed6632d56b3aa602
Create hunting rule
ssdeep : 768:/ZAOGCQn0+mPuCPEJ1aMlYKpFOwmMWeSWo3XxebzraHOIWP2hU3Bhs:/ZDGd0rPuWyaiJXOIeXgbzr7PjT
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : b6caeab2eac8e871
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:be13fc82-c685-11f0-adeb-42010aa4000b
File name:400000.65f7040d-475c-4eeb-9220-826ca4fe3f6a.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Dropper.Pajetbin-7136153-0
Create hunting rule
Signature:Win.Trojan.Fearso-6722844-0
Create hunting rule
Signature:Win.Trojan.VBGeneric-6735883-1
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:SUSP_VBS_Wscript_Shell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the definition of 'Wscript.Shell' which is often used by Malware, FPs are possible and commmon
TLP:TLP:WHITE
Repository:SIFalcon
Rule name:upx_3
Create hunting rule
Author:Kevin Falcoz
Description:UPX 3.X
TLP:TLP:WHITE
Rule name:UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.