YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 7f400061e90a526c2d8b3ad26acb1e6ed34b8a589ee382d6be7e2155fe64b07e.

SHA256 hash:	7f400061e90a526c2d8b3ad26acb1e6ed34b8a589ee382d6be7e2155fe64b07e
File size:	937'872 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	c1f59e5f1250202c5f7a1c045ce577aa
SHA1 hash:	00c81329e990f8999a6ef697ca82b0414148cd3d
SHA3-384 hash:	4164545179960438027e6383c3601438b58b8de2daf36f047fbc7b1ff8c82488054894b5aacc89f1c32d496b526a0206
First seen:	2026-01-15 15:29:10 UTC
Last seen:	Never
Sightings:	1
imphash :	cbc539a50cd7367f282684d851a5a9a5 Create hunting rule
ssdeep :	12288:jxhBec51alq+09HngMmP4zvaLxf36tRg6BJPBy/WjaRXIacY:j/B+4z876zPBymapIacY
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	8c333333174c3002 Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	pe_detect_tls_callbacks Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits
TLP:	TLP:WHITE
Repository:

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-01-15 15:29:10 UTC Static: 6 Unpacker: 0 ClamAV: 0