YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 70b2b4a640daa2c11e4ca6d369875768abd468f952a18e34d05850e4525e50eb.

Scan Results

SHA256 hash: 70b2b4a640daa2c11e4ca6d369875768abd468f952a18e34d05850e4525e50eb
File size:278'528 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 115e46a2fa75dd323e80c6aa8103e060
SHA1 hash: b0a0ddc2ac5cdbe0a17c69d8f4d137c67c6a1283
SHA3-384 hash: dc9d1da87ebb48c8f194eebfac1a6d32336a39bbef26d88c76fc7273c05787840ee2de496b2e640bf895675d8a163748
First seen:2025-11-20 23:59:51 UTC
Last seen:Never
Sightings:1
imphash : 11520ea06ca7a22e5ad6e376a522a4d7
Create hunting rule
ssdeep : 3072:MMBGBT753Q+RgWgMlIx1ZiXjb6aEF6D0NM9voeLNZ2j8Cm2:pw753RgWg4aAXjb6aEFfooeLNZxC
TLSH : T1C244C416BA12841AF691C4B53925D1AEB9197F322452BD5BF3923F4B34312D3B1F2B23
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon : 04ccfee2ece4a484
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:00c13da4-c66d-11f0-adeb-42010aa4000b
File name:115e46a2fa75dd323e80c6aa8103e060
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Trojan.VBGeneric-6735802-0
Create hunting rule
Signature:Win.Worm.Brontok-9936812-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:SEH__vba
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER
Rule name:win_upx_packed
Create hunting rule
Author:Reedus0
Description:Rule for detecting UPX packed malware
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.