YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 3fe4db596dd8ceed4f6e225aa2d115b4335e5b2e684a170a73a04625fb83ad4a.
Scan Results
| SHA256 hash: | 3fe4db596dd8ceed4f6e225aa2d115b4335e5b2e684a170a73a04625fb83ad4a | |
|---|---|---|
| File size: | 657'408 bytes | |
| File download: | Original | |
| MIME type: | application/x-dosexec | |
| MD5 hash: | 7cb7e6f1f79daddcab2aabc77f5f9934 | |
| SHA1 hash: | cb60da5975938899b7e2dae15e45ba9480609933 | |
| SHA3-384 hash: | 2c7a718473b8581ee9948f2eb5fe9a23fe04c224db1fe9e05220c3347695a789596133480001910341c0310e2a6e23d6 | |
| First seen: | 2026-03-15 10:01:15 UTC | |
| Last seen: | 2026-03-15 10:04:48 UTC | |
| Sightings: | 2 | |
| imphash : | n/a | |
| ssdeep : | 12288:waqyhmuIzDEXSVm2qg0SsRQwbV72HYuNbs/a/0xMVxEZKxb2O:wTyCDR/qgXsawJ6Y1MMZKxb2 | |
| TLSH : | n/a | |
| telfhash : | n/a | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | 6691a64d-2056-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | 4a30000.exe | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | pe_no_import_table |
|---|---|
| Author: | |
| Description: | Detect pe file that no import table |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | SUSP_XORed_URL_In_EXE |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects an XORed URL in an executable |
| Reference: | https://twitter.com/stvemillertime/status/1237035794973560834 |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_URL_in_EXE_RID2E46 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects an XORed URL in an executable |
| Reference: | https://twitter.com/stvemillertime/status/1237035794973560834 |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | e7a55d00-2055-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | 4a30000.exe | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | pe_no_import_table |
|---|---|
| Author: | |
| Description: | Detect pe file that no import table |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | SUSP_XORed_Mozilla_Oct19 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key. |
| Reference: | https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force() |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_Mozilla_RID2DB4 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed keyword - Mozilla/5.0 |
| Reference: | Internal Research |
| TLP: | TLP:WHITE |
| Rule name: | SUSP_XORed_URL_In_EXE |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects an XORed URL in an executable |
| Reference: | https://twitter.com/stvemillertime/status/1237035794973560834 |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | SUSP_XORed_URL_in_EXE_RID2E46 |
|---|---|
| Author: | Florian Roth |
| Description: | Detects an XORed URL in an executable |
| Reference: | https://twitter.com/stvemillertime/status/1237035794973560834 |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter