YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 8d8b26c1d995af9be1e153babec6e37d10be30d03beb3d396940e241be630954.

SHA256 hash:	8d8b26c1d995af9be1e153babec6e37d10be30d03beb3d396940e241be630954
File size:	55'269 bytes
File download:	Original Unpacked
MIME type:	application/x-dosexec
MD5 hash:	12444e16e65af1d59305c823733c715e
SHA1 hash:	7ac210d122ed6bf4a39e430c5bb273328c27881e
SHA3-384 hash:	3c022b431ac68560bcc67ab9a25da2f3f4fd9feeac54024aa9b64e22eb3ae2b3a03dd4b40fa2ede2b41482eedce749dd
First seen:	2026-03-11 15:29:32 UTC
Last seen:	Never
Sightings:	1
imphash :	bd227ba966c127e93fe82f25f211eaca Create hunting rule
ssdeep :	768:8v4MEc04ZzLh3VtAghWjg8qstaNC7WlH8VTrf7AshVN/OEl:8wMEcVLh3QghuGCqV8V3zhbl
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	f4b484ece0f0d860 Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	PUA.Win.Packer.Expressor-1 Create hunting rule

Signature:	PUA.Win.Packer.Expressor-27 Create hunting rule

Signature:	PUA.Win.Packer.Expressor-5 Create hunting rule

Signature:	Win.Dropper.Gh0stRAT-7645027-0 Create hunting rule

Signature:	Win.Malware.Hupigon-9845802-0 Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	eXPressorv13CGSoftLabs Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	INDICATOR_EXE_Packed_eXPressor Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with eXPressor
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	RSharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	identifiers for remote and gmremote
TLP:	TLP:WHITE

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-03-11 15:29:33 UTC Static: 3 Unpacker: 0 ClamAV: 5