YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 5390d6eab778dc1c841febc505ffa939cb0b26f9ee44519659ccd46dd301fbbc.

Scan Results

SHA256 hash: 5390d6eab778dc1c841febc505ffa939cb0b26f9ee44519659ccd46dd301fbbc
File size:4'579'872 bytes
File download: Original Unpacked
MIME type:application/x-dosexec
MD5 hash: 09cfd0e42b8e3b6c86bead064de0c191
SHA1 hash: 3b655797e658b5d977049d644161d0928237b597
SHA3-384 hash: 1f2cabd06248e80c884f35a1a4755448a0fe58dc20225e653189aeb034f70035536f2bcd4412ccb7313994b3d69c4b7b
First seen:2025-11-20 23:55:12 UTC
Last seen:Never
Sightings:1
imphash : f34d5f2d4577ed6d9ceec516c1f5a744
Create hunting rule
ssdeep : 98304:WhEVQJ25UvldkB9nKWX6zHaGvrO6kRK/UyvF:lVw2iTqnKWKzHKpkp
TLSH : T10826127CB2DA6C40E4AE617E8009E040192D8E753F03DA059652F29B77BB9474FBB1ED
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon : dc4a6af0f0b284e4
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:5aa37b7c-c66c-11f0-adeb-42010aa4000b
File name:09cfd0e42b8e3b6c86bead064de0c191
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER
Rule name:Any_SU_Domain
Create hunting rule
Author:you
Description:Detect any reference to .su domains or subdomains
TLP:TLP:WHITE
Repository:YARAify
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:TLP:WHITE
Repository:YARAify
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:pe_imphash
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.