YARAify Scan Results

Task Information

---

Task ID:	be079472-0770-11f1-82f6-42010aa4000b
File name:	400000.1870e69042eda56a561ed6df236ed181.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Malware.Ulise-9951851-0 Alert Create hunting rule

Signature:	Win.Trojan.Rincux-6417593-0 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CN_disclosed_20180208_Mal1 Alert Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CN_disclosed_20180208_Mal1_RID2F59 Alert Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
TLP:	TLP:WHITE

Rule name:	CP_Script_Inject_Detector Alert Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	FreddyBearDropper Alert Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Alert Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	pe_no_import_table Alert Create hunting rule
Author:
Description:	Detect pe file that no import table
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.