YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 59987fcb72f4d9fb9fa838a2bd1d6ca5c1dd9f0f442e7b70470ab2f0295dae77.

Scan Results


SHA256 hash: 59987fcb72f4d9fb9fa838a2bd1d6ca5c1dd9f0f442e7b70470ab2f0295dae77
File size:477'775 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: b687cfff58adab45ffa698b500548a73
SHA1 hash: 1009c621a6c802325614faa0a704ebc900e88dc4
SHA3-384 hash: 772a75fdff59e0c99cb3dee8eb4aef17f870887fe139392789130241273989c600960082a6bc35f8bb5b23fb28b75ef5
First seen:2022-11-24 19:50:14 UTC
Last seen:Never
Sightings:1
imphash : 2a117f0ed09337459d5cab41af2126d6
ssdeep : 6144:+Y+32WWluqvHpVmXWEjFJRWci+WUd20zr+UU5EYCTvaBju4zG:lnWwvHpVmXpjJIUd2NUusvalxz
TLSH : T1D0A4293AEB20B116FA578C7A78294E1A15283C3562119E4BB3926B4D34767C3F9F434F
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:36a73a14-6c31-11ed-a71a-42010aa4000b
File name:400000.system.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Lmvwkprng-6742707-0
Signature:Win.Malware.Lmvwkprng-6742708-0
Signature:Win.Malware.Lmvwkprng-6803869-0
Signature:Win.Malware.Moonlight-9890813-0
Signature:Win.Malware.Moonlight-9890875-0
Signature:Win.Malware.Moonlight-9919382-0
Signature:Win.Malware.Moonlight-9919383-0
Signature:Win.Malware.Moonlight-9934254-0
Signature:Win.Malware.Moonlight-9934996-0
Signature:Win.Packed.Moonlight-9934265-0
Signature:Win.Packer.VbPack-0-6334882-0
Signature:Win.Trojan.Moonlight-9881795-0
Signature:Win.Worm.Moonlight-9775620-0
Signature:Win.Worm.Moonlight-9779178-0
Signature:Win.Worm.Ulise-9778387-0
Signature:Win.Worm.Ulise-9779043-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:INDICATOR_EXE_Packed_MPress
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:ditekshen
Rule name:meth_get_eip
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:yaraify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.