YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 4abba6257d1b2011ae1f4edb329f717ff7c80343e41a1c3418b4d274774e7f19.

Scan Results

SHA256 hash:	4abba6257d1b2011ae1f4edb329f717ff7c80343e41a1c3418b4d274774e7f19
File size:	1'319'931 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	1f05b62cd5229026e8ee9346a1bfe7b1
SHA1 hash:	f8f7759f790a6116c7b8e1282c8287abb56b1762
SHA3-384 hash:	ccd2b4999076c197850cbbe3d33b098797cf85bdf862a411578e827605e890bd507fab52dee80c6db062d2b864134596
First seen:	2025-11-20 23:47:48 UTC
Last seen:	2025-11-20 23:52:02 UTC
Sightings:	5
imphash :	91ae93ed3ff0d6f8a4f22d2edd30a58e Create hunting rule
ssdeep :	24576:R3oCTWeZTfxnW9yFdNM+lu8n5bpGLIe1hdp1YdGrksfC3fTItkgbVU4:R3XTWsTBDNQ2iselXOfTITJF
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	7c70747474d67274 Create hunting rule

Tasks

There are 5 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	e91ffee7-c66b-11f0-adeb-42010aa4000b
File name:	Photo.scr
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Python.Stealer.22.UNOFFICIAL Create hunting rule

Signature:	Win.Malware.F857af-9782749-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9950875-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9951150-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_PyInstaller Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PyInstaller compiled executables across platforms
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:	TLP:WHITE
Repository:	bartblaze

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

Task Information

Task ID:	c4fee6cc-c66b-11f0-adeb-42010aa4000b
File name:	Photo.scr
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Python.Stealer.22.UNOFFICIAL Create hunting rule

Signature:	Win.Malware.F857af-9782749-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9950875-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9951150-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_PyInstaller Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PyInstaller compiled executables across platforms
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:	TLP:WHITE
Repository:	bartblaze

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

Task Information

Task ID:	a0ee5bfa-c66b-11f0-adeb-42010aa4000b
File name:	Photo.scr
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Python.Stealer.22.UNOFFICIAL Create hunting rule

Signature:	Win.Malware.F857af-9782749-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9950875-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9951150-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_PyInstaller Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PyInstaller compiled executables across platforms
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:	TLP:WHITE
Repository:	bartblaze

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

Task Information

Task ID:	7d821ac6-c66b-11f0-adeb-42010aa4000b
File name:	Photo.scr
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Python.Stealer.22.UNOFFICIAL Create hunting rule

Signature:	Win.Malware.F857af-9782749-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9950875-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9951150-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_PyInstaller Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PyInstaller compiled executables across platforms
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:	TLP:WHITE
Repository:	bartblaze

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found

Task Information

Task ID:	51a12ba9-c66b-11f0-adeb-42010aa4000b
File name:	1f05b62cd5229026e8ee9346a1bfe7b1
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	SecuriteInfo.com.Python.Stealer.22.UNOFFICIAL Create hunting rule

Signature:	Win.Malware.F857af-9782749-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9950875-0 Create hunting rule

Signature:	Win.Malware.Ymacco-9951150-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_PyInstaller Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PyInstaller compiled executables across platforms
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:	TLP:WHITE
Repository:	bartblaze

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

YARAify Scan Results

Scan Results Rescan

Tasks

2025-11-20 23:52:02 UTC Static: 5 Unpacker: 0 ClamAV: 4

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-11-20 23:51:01 UTC Static: 5 Unpacker: 0 ClamAV: 4

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-11-20 23:50:01 UTC Static: 5 Unpacker: 0 ClamAV: 4

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-11-20 23:49:01 UTC Static: 5 Unpacker: 0 ClamAV: 4

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2025-11-20 23:47:48 UTC Static: 5 Unpacker: 0 ClamAV: 4

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

Scan Results