YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 6cb322f63f55448c6599ecd0d7f95f026a1fc18e2fa5dc1d2716e6667b3ea91e.

Scan Results

SHA256 hash:	6cb322f63f55448c6599ecd0d7f95f026a1fc18e2fa5dc1d2716e6667b3ea91e
File size:	5'298'176 bytes
File download:	Original
MIME type:	application/vnd.microsoft.portable-executable
MD5 hash:	a44c91d71e1d2868ab50cdf0c0eb9f54
SHA1 hash:	876510ff57d0c44a92740eb9d83e252912833334
SHA3-384 hash:	40a79c26fc5ab886ee638215a39d35694580f2e799d9369a130e2018d775db38fcdceba5690bbe2553e3756f1b5d0c53
First seen:	2026-10-30 20:15:24 UTC
Last seen:	2026-10-30 20:16:39 UTC
Sightings:	2
imphash :	0cdadfa1098d845dd3b4cf92625b5f04 Create hunting rule
ssdeep :	24576:jbLg3bLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRY:jn2nAQqMSPbcBVQej/1
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	d05e16aa-d49e-11f1-ae09-42010aa4000b
File name:	a44c91d71e1d2868ab50cdf0c0eb9f54
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	BC.Win.Exploit.Exe_With_CVE_2017_0147-6316126-2 Create hunting rule

Signature:	Win.Exploit.Doublepulsar-7427328-0 Create hunting rule

Signature:	Win.Malware.Djwy-6775897-0 Create hunting rule

Signature:	Win.Malware.Djwy-6923377-0 Create hunting rule

Signature:	Win.Ransomware.Wanacryptor-9942127-1 Create hunting rule

Signature:	Win.Ransomware.Wanna-6888027-0 Create hunting rule

Signature:	Win.Ransomware.Wanna-6888334-0 Create hunting rule

Signature:	Win.Ransomware.Wanna-9769986-0 Create hunting rule

Signature:	Win.Ransomware.WannaCry-10011460-0 Create hunting rule

Signature:	Win.Ransomware.WannaCry-6313787-0 Create hunting rule

Signature:	Win.Ransomware.Wannacryptor-9940180-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	WannaCry_Ransomware Create hunting rule
Author:	Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:	Detects WannaCry Ransomware
Reference:	https://goo.gl/HG2j5T
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WannaCry_Ransomware_Main Create hunting rule
Author:	Bristol Agri-Tech Solutions SOC
Description:	Detects WannaCry ransomware main executable
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

Task Information

Task ID:	a445c8e7-d49e-11f1-ae09-42010aa4000b
File name:	6cb322f63f55448c6599ecd0d7f95f026a1fc18e2fa5dc1d2716e6667b3ea91e.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	BC.Win.Exploit.Exe_With_CVE_2017_0147-6316126-2 Create hunting rule

Signature:	Win.Exploit.Doublepulsar-7427328-0 Create hunting rule

Signature:	Win.Malware.Djwy-6775897-0 Create hunting rule

Signature:	Win.Malware.Djwy-6923377-0 Create hunting rule

Signature:	Win.Ransomware.Wanacryptor-9942127-1 Create hunting rule

Signature:	Win.Ransomware.Wanna-6888027-0 Create hunting rule

Signature:	Win.Ransomware.Wanna-6888334-0 Create hunting rule

Signature:	Win.Ransomware.Wanna-9769986-0 Create hunting rule

Signature:	Win.Ransomware.WannaCry-10011460-0 Create hunting rule

Signature:	Win.Ransomware.WannaCry-6313787-0 Create hunting rule

Signature:	Win.Ransomware.Wannacryptor-9940180-0 Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	WannaCry_Ransomware Create hunting rule
Author:	Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:	Detects WannaCry Ransomware
Reference:	https://goo.gl/HG2j5T
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WannaCry_Ransomware_Main Create hunting rule
Author:	Bristol Agri-Tech Solutions SOC
Description:	Detects WannaCry ransomware main executable
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.

Disabled by submitter

YARAify Scan Results

Scan Results Rescan

Tasks

2026-10-30 20:16:39 UTC Static: 7 Unpacker: 0 ClamAV: 11

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

2026-10-30 20:15:25 UTC Static: 7 Unpacker: 0 ClamAV: 11

Task Information

ClamAV Results

YARA Results

Static Analysis

Unpacker

Unpacked Files

Scan Results