YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 73cae9d4d18383fda64b7c5b948019b976c5b5d65fc4de94fbc6514f2b1b9346.

Scan Results

SHA256 hash: 73cae9d4d18383fda64b7c5b948019b976c5b5d65fc4de94fbc6514f2b1b9346
File size:1'412'298 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 0cd9fdabe846d35406161c06d554d9ff
SHA1 hash: d7117d4b0362763ecbcc381f90585b5ec1cc250e
SHA3-384 hash: 8df635011b2b74882ad0b78925b3c4d3c2d655ef015f8ce9ffd7c6ef6cedd905bc91f43ed44cdb9d778b08edd2a98c61
First seen:2026-04-27 15:05:29 UTC
Last seen:Never
Sightings:1
imphash : b144870e3a37e200b228432e9ff61d95
Create hunting rule
ssdeep : 24576:rjhXeF6y8u1FtnN1Y0KxxAq2qMnhtUqZJPZkDO:nnyN1rnvYRxMkSZ
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:87b95ccb-424a-11f1-badc-42010aa4000b
File name:0cd9fdabe846d35406161c06d554d9ff
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Downloader.Unruy-6912807-0
Create hunting rule
Signature:Win.Trojan.Unruy-5515
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.