YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 398baf86bad80aa404dd149d1f3656fa0ef42135ea6d6189061570e598ffedee.

Scan Results

SHA256 hash: 398baf86bad80aa404dd149d1f3656fa0ef42135ea6d6189061570e598ffedee
File size:26'345 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 1128b382c9217bebfaedfb02ddfdc10f
SHA1 hash: 0fd671dbd0c3b42d76efde25572b9c302aa980d9
SHA3-384 hash: cdec309de7dec2387cf0d9f728f6ea5bb45c494235a6975ce4827c3da4e2a5237895614945dc9d03ed0d415bea0c18b5
First seen:2025-11-21 02:59:20 UTC
Last seen:Never
Sightings:1
imphash : e95e3c19c1b1846eddfe9b97188d572c
Create hunting rule
ssdeep : 384:ErzPbGFKDE68AqAVQG8l2fSswKMfL3d3V4OSHSPY+HzOmaMJXKE:ErzbNDE6d3QQKscL3xTYKOma0d
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:13660beb-c686-11f0-adeb-42010aa4000b
File name:1128b382c9217bebfaedfb02ddfdc10f
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:MiscreantPunch.SingleXOR.EXE.97.UNOFFICIAL
Create hunting rule
Signature:Win.Downloader.10842-2
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
TLP:TLP:WHITE
Repository:Neo23x0

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.