YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 3b9dcd0a491f3a87f18624d213639bd003b856cb38952e05d234ab3082f214dc.

Scan Results

SHA256 hash: 3b9dcd0a491f3a87f18624d213639bd003b856cb38952e05d234ab3082f214dc
File size:4'608 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: f7e61d1fd15d71cddcc47cc99ae6b057
SHA1 hash: 749f2b3fdb280b862825d88224d63fbcadc13bc3
SHA3-384 hash: d0157b3b903ad51e51767f59a9f3a4b88fee8accd0451a1c59ee9de1fa73f9429f7d39b699b39f242e2353bce8c92f5c
First seen:2025-11-21 02:55:58 UTC
Last seen:Never
Sightings:1
imphash : e836076a09dba03e4d6faa46dda0fefc
Create hunting rule
ssdeep : 48:9/fUYV6Uxsy7YSRowpTHeovfPRVh1rsHB/VnC/RAxUDCSC:9kQdycLGw/huHnnwR2UDCt
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:9b8bf1e6-c685-11f0-adeb-42010aa4000b
File name:2740000.hcbnaf.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
TLP:TLP:WHITE
Repository:Neo23x0

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.