YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 71e61877c3583001d48a563cf888b8a7b9f3d1b6206ef41ac2d96233620c2f24.

Scan Results

SHA256 hash: 71e61877c3583001d48a563cf888b8a7b9f3d1b6206ef41ac2d96233620c2f24
File size:85'577 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 03520da3b2af4948addb3bda930b268a
SHA1 hash: 62682652bf451222d1db010ac85c661b65a4940f
SHA3-384 hash: 953bc30455a6e36ca28d1e441eb7989ccfdb4bfa9c8086a78809a2e364931257b398c1add573d904a68f24d3c42a46d1
First seen:2026-04-27 14:58:49 UTC
Last seen:Never
Sightings:1
imphash : 054a1a03fbadd17ec01f39f9c28d3ce7
Create hunting rule
ssdeep : 1536:jv1IeEN0ZcArGvjNcLBOT9KGJs9KGLPD1EUJ0:CdyZcRv5ykF4b1Eb
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:995c22f2-4249-11f1-badc-42010aa4000b
File name:03520da3b2af4948addb3bda930b268a
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.Siggen9.43023.3181.25708.UNOFFICIAL
Create hunting rule
Signature:Win.Ransomware.Gandcrab-10056444-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:UPXv20MarkusLaszloReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.