YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 6dbb9f1dab4baf988e1ad67f23ae3f2fd59c933237fbbbb1f901ca80b7039ce1.

Scan Results


SHA256 hash: 6dbb9f1dab4baf988e1ad67f23ae3f2fd59c933237fbbbb1f901ca80b7039ce1
File size:477'618 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 158876a7d626900635774e6c4a692183
SHA1 hash: 61b680527fc828f17d2940bad18ce4ed4cbb9b16
SHA3-384 hash: 7cf4bf3c43d6c31eb85e708072308d229ebde7efda937cf95412d54a5f6b43c309cdfa1996d5ae3fe313f8d49f4437fb
First seen:2022-11-24 19:50:14 UTC
Last seen:Never
Sightings:1
imphash : 5484aaf95f1ca2156afa7241fbb255ac
ssdeep : 6144:rY+32WWluqvHpVmXWEjFJRWci+WUd20/or+UU5EYCTvaBju4z:knWwvHpVmXpjJIUd2iUusvalxz
TLSH : T114A4283AEB20B116FA578C7A78294E1A15283C3562119E4BB3926B4D34767C3F9F434F
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:367abdf5-6c31-11ed-a71a-42010aa4000b
File name:400000.smss.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Lmvwkprng-6742707-0
Signature:Win.Malware.Lmvwkprng-6742708-0
Signature:Win.Malware.Lmvwkprng-6803869-0
Signature:Win.Malware.Moonlight-9890813-0
Signature:Win.Malware.Moonlight-9890875-0
Signature:Win.Malware.Moonlight-9919382-0
Signature:Win.Malware.Moonlight-9919383-0
Signature:Win.Malware.Moonlight-9934254-0
Signature:Win.Malware.Moonlight-9934996-0
Signature:Win.Packed.Moonlight-9934265-0
Signature:Win.Packer.VbPack-0-6334882-0
Signature:Win.Trojan.Moonlight-9881795-0
Signature:Win.Worm.Moonlight-9775620-0
Signature:Win.Worm.Moonlight-9779178-0
Signature:Win.Worm.Ulise-9778387-0
Signature:Win.Worm.Ulise-9779043-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:INDICATOR_EXE_Packed_MPress
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:ditekshen
Rule name:meth_get_eip
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:yaraify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.