YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 455eef563d4e19947cb6e7adf0f300110b33c88573cbe59f5acae4306e39ffa4.

Scan Results

SHA256 hash: 455eef563d4e19947cb6e7adf0f300110b33c88573cbe59f5acae4306e39ffa4
File size:8'192 bytes
File download: Original
MIME type:application/octet-stream
MD5 hash: 9d75d0e0ed666a463095bd9e503b7bc5
SHA1 hash: 3987d9ff8e6cafa76959a6823f2bb3b7b5d718f1
SHA3-384 hash: 9870192a7035c391678d9b7ba9c920d06d5fcc38ce67c2ebd5f447f61f389097bd0f65b16ba6e7b7f4060df510defca6
First seen:2026-06-29 04:52:56 UTC
Last seen:2026-06-29 04:52:58 UTC
Sightings:2
imphash :n/a
ssdeep : 96:GLYz0CLhNsTcEIXcnpQcggdxlZim7LnBVJlXlggDMUKWbizc5+g9JvAjpj:GLYrqJIXcnHgeeGTGzc5f/v2t
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:66138e74-7376-11f1-ad5e-42010aa4000b
File name:28d0000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:YARA.MALPEDIA_Win_Sality_Auto.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:win_sality_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.sality.
TLP:TLP:WHITE
Repository:Malpedia

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.

Task Information

Task ID:65622686-7376-11f1-ad5e-42010aa4000b
File name:28d0000.corrupt_dll
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:YARA.MALPEDIA_Win_Sality_Auto.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:win_sality_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.sality.
TLP:TLP:WHITE
Repository:Malpedia

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.