YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 44b6d6327e7138a8cd9f3310175b85f86d310ca89c466b2b9698ab0a25cd4e52.

SHA256 hash:	44b6d6327e7138a8cd9f3310175b85f86d310ca89c466b2b9698ab0a25cd4e52
File size:	1'634'304 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	f6304291dc126a1f4b5e1d8379b92040
SHA1 hash:	de2a8bd382f6b3ca3c3a5f409aea1b2ad580c53b
SHA3-384 hash:	97210eba87f060e44810ad01136872f3b880b120d6a274734c46afb633ac78e17a35deaa20a6c1ea05feafdcb6351067
First seen:	2026-10-10 10:15:14 UTC
Last seen:	Never
Sightings:	1
imphash :	9171e85ca17a3df453234f4592d45f17 Create hunting rule
ssdeep :	24576:dg3qe85ZXGMBx2DlxJJBwuCx59U4IgL5p:y3qf5ZD2ZbJBwuOTU4I
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	bae2e5e7e5a5a69a Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE
Repository:

Rule name:	skip20_sqllang_hook Create hunting rule
Author:	Mathieu Tartare <mathieu.tartare@eset.com>
Description:	YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:	https://www.welivesecurity.com/
TLP:	TLP:WHITE
Repository:

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_SliverFox_ForgeAuto_c1e18461 Create hunting rule
Author:	Marjoriefort
Description:	Detects SliverFox (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_37b4704b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-10 10:15:14 UTC Static: 11 Unpacker: 0 ClamAV: 0