YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 40cfcb6c00ecdf84d9c7bb275c6d476aa1d7250ae0a3467627242868b4f3dcc8.
Scan Results
| SHA256 hash: | 40cfcb6c00ecdf84d9c7bb275c6d476aa1d7250ae0a3467627242868b4f3dcc8 | |
|---|---|---|
| File size: | 8'994'816 bytes | |
| File download: | Original | |
| MIME type: | application/zip | |
| MD5 hash: | 3d107c0d4a0b7f17abdc623d7dd9627d | |
| SHA1 hash: | 93cff9d3762be5f96bba0e306a997de6a68301fe | |
| SHA3-384 hash: | 8a6b4d187b8d743011404b690e18fa541f1c7c2739bebc3d7f987d8903d0a8f46a1ab77c414a7fea720d6ec2d4ee8165 | |
| First seen: | 2026-01-10 08:35:03 UTC | |
| Last seen: | 2026-01-10 08:38:03 UTC | |
| Sightings: | 4 | |
| imphash : | n/a | |
| ssdeep : | 196608:731lgyOjUR61IPtb+MSr+V7HNCVUdQu3097FUewARzA+yntMFtTLUH2bG+SNAB02:7NFqIpSrGzgYH30tuewA2+yncpLFON0R | |
| TLSH : | n/a | |
| telfhash : | n/a | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 0 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | ad84a8db-edff-11f0-9df4-42010aa4000b | |
|---|---|---|
| File name: | windows2.zip | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | SecuriteInfo.com.Program.Unwanted.5065.UNOFFICIAL |
|---|
| Signature: | SecuriteInfo.com.UntrustedCertificate.iObit-1.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Check_OutputDebugStringA_iat |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | hunt_skyproj_backdoor |
|---|---|
| Author: | SBousseaden |
| Reference: | https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/ |
| TLP: | TLP:WHITE |
| Repository: | sbousseaden |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Reference: | classified |
| TLP : | TLP:AMBER |
| Rule name: | ldpreload |
|---|---|
| Author: | xorseed |
| Reference: | https://stuff.rop.io/ |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | pe_detect_tls_callbacks |
|---|---|
| Author: | |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Sectigo_Code_Signed |
|---|---|
| Description: | Detects code signed by the Sectigo RSA Code Signing CA |
| Reference: | https://bazaar.abuse.ch/export/csv/cscb/ |
| TLP: | TLP:WHITE |
| Repository: | Sandnet |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | test_Malaysia |
|---|---|
| Author: | rectifyq |
| Description: | Detects file containing malaysia string |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_Generic_MassHunt_Win_Malware_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Windows malware mass-hunt rule - 2025 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | win_sysscan_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
| TLP: | TLP:WHITE |
| Repository: | Malpedia |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 89e2d7d1-edff-11f0-9df4-42010aa4000b | |
|---|---|---|
| File name: | windows2.zip | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | SecuriteInfo.com.Program.Unwanted.5065.UNOFFICIAL |
|---|
| Signature: | SecuriteInfo.com.UntrustedCertificate.iObit-1.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Check_OutputDebugStringA_iat |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | hunt_skyproj_backdoor |
|---|---|
| Author: | SBousseaden |
| Reference: | https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/ |
| TLP: | TLP:WHITE |
| Repository: | sbousseaden |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Reference: | classified |
| TLP : | TLP:AMBER |
| Rule name: | ldpreload |
|---|---|
| Author: | xorseed |
| Reference: | https://stuff.rop.io/ |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | pe_detect_tls_callbacks |
|---|---|
| Author: | |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Sectigo_Code_Signed |
|---|---|
| Description: | Detects code signed by the Sectigo RSA Code Signing CA |
| Reference: | https://bazaar.abuse.ch/export/csv/cscb/ |
| TLP: | TLP:WHITE |
| Repository: | Sandnet |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | test_Malaysia |
|---|---|
| Author: | rectifyq |
| Description: | Detects file containing malaysia string |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_Generic_MassHunt_Win_Malware_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Windows malware mass-hunt rule - 2025 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | win_sysscan_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
| TLP: | TLP:WHITE |
| Repository: | Malpedia |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 660b658e-edff-11f0-9df4-42010aa4000b | |
|---|---|---|
| File name: | windows2.zip | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | SecuriteInfo.com.Program.Unwanted.5065.UNOFFICIAL |
|---|
| Signature: | SecuriteInfo.com.UntrustedCertificate.iObit-1.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Check_OutputDebugStringA_iat |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | hunt_skyproj_backdoor |
|---|---|
| Author: | SBousseaden |
| Reference: | https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/ |
| TLP: | TLP:WHITE |
| Repository: | sbousseaden |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Reference: | classified |
| TLP : | TLP:AMBER |
| Rule name: | ldpreload |
|---|---|
| Author: | xorseed |
| Reference: | https://stuff.rop.io/ |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | pe_detect_tls_callbacks |
|---|---|
| Author: | |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Sectigo_Code_Signed |
|---|---|
| Description: | Detects code signed by the Sectigo RSA Code Signing CA |
| Reference: | https://bazaar.abuse.ch/export/csv/cscb/ |
| TLP: | TLP:WHITE |
| Repository: | Sandnet |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | test_Malaysia |
|---|---|
| Author: | rectifyq |
| Description: | Detects file containing malaysia string |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_Generic_MassHunt_Win_Malware_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Windows malware mass-hunt rule - 2025 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | win_sysscan_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
| TLP: | TLP:WHITE |
| Repository: | Malpedia |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found
Task Information
| Task ID: | 42ac4ae2-edff-11f0-9df4-42010aa4000b | |
|---|---|---|
| File name: | windows2.zip | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | True | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | SecuriteInfo.com.Program.Unwanted.5065.UNOFFICIAL |
|---|
| Signature: | SecuriteInfo.com.UntrustedCertificate.iObit-1.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Check_OutputDebugStringA_iat |
|---|---|
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| TLP: | TLP:WHITE |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | hunt_skyproj_backdoor |
|---|---|
| Author: | SBousseaden |
| Reference: | https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/ |
| TLP: | TLP:WHITE |
| Repository: | sbousseaden |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| Reference: | classified |
| TLP : | TLP:AMBER |
| Rule name: | ldpreload |
|---|---|
| Author: | xorseed |
| Reference: | https://stuff.rop.io/ |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | pe_detect_tls_callbacks |
|---|---|
| Author: | |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Sectigo_Code_Signed |
|---|---|
| Description: | Detects code signed by the Sectigo RSA Code Signing CA |
| Reference: | https://bazaar.abuse.ch/export/csv/cscb/ |
| TLP: | TLP:WHITE |
| Repository: | Sandnet |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | test_Malaysia |
|---|---|
| Author: | rectifyq |
| Description: | Detects file containing malaysia string |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | TH_Generic_MassHunt_Win_Malware_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Windows malware mass-hunt rule - 2025 |
| Reference: | https://cyfare.net/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | win_sysscan_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | autogenerated rule brought to you by yara-signator |
| TLP: | TLP:WHITE |
| Repository: | Malpedia |
| Rule name: | with_urls |
|---|---|
| Author: | Antonio Sanchez <asanchez@hispasec.com> |
| Description: | Rule to detect the presence of an or several urls |
| Reference: | http://laboratorio.blogs.hispasec.com/ |
| TLP: | TLP:WHITE |
Unpacker
The following YARA rules matched on the unpacked file.
No matches
Unpacked Files
The following files could be unpacked from this sample.
No unpacked files found