YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 56308af93d42fe2ace9f6d30a43865b74fca6e829bac9a3100908090b2276a5b.

Scan Results

SHA256 hash: 56308af93d42fe2ace9f6d30a43865b74fca6e829bac9a3100908090b2276a5b
File size:10'609'664 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 0fae10ed92bc46d4e6ab0bf2fd844717
SHA1 hash: fa612fe153d4fcd53cdf5c3cffc0b6b5172ab825
SHA3-384 hash: 10db30bc47ee1d9e47ac510479acb710b723e69ef02a54b4f9a1935524baf845261066b837788f57a8f1a55ffd606ead
First seen:2025-11-21 00:03:24 UTC
Last seen:Never
Sightings:1
imphash : 96ad112daaa8350b6e84b3e0e519e5bc
Create hunting rule
ssdeep : 196608:pVEVNVuJiVuJRZZcIOh0VuJRZZcIOhGvrS0:7WXuyu3uJv+
TLSH : T1B8B6BF117552C131E2A101B1997DAFB6846CAE245B704DCB93C47E2AFA722D37732F3A
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:7fde9b0d-c66d-11f0-adeb-42010aa4000b
File name:0fae10ed92bc46d4e6ab0bf2fd844717
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
TLP:TLP:WHITE
Repository:
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
TLP:TLP:WHITE
Repository:
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
TLP:TLP:WHITE
Repository:
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
TLP:TLP:WHITE
Repository:
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
TLP:TLP:WHITE
Repository:
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
TLP:TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.