YARAify Scan Results

Task Information

---

Task ID:	4620cbd4-9c94-11ed-98c2-42010aa4000b
File name:	400000.756b31fa-560-4ff3-9b64-9fa9b59bb554.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Malware.Delf-9983630-0 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	INDICATOR_EXE_Packed_VMProtect Alert Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.
TLP:	TLP:WHITE
Repository:	ditekshen

Rule name:	SUSP_XORed_Mozilla Alert Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Alert Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research
TLP:	TLP:WHITE

Rule name:	VMProtectStub Alert Create hunting rule
Author:	@bartblaze
Description:	Identifies VMProtect packer stub.
TLP:	TLP:WHITE
Repository:	bartblaze

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.