Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated. ➡️ Read here for more info

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 95494613a2a1b5459b269349a85d235c9d17a12cada7423431f7c3742b3388eb.

Scan Results

SHA256 hash: 95494613a2a1b5459b269349a85d235c9d17a12cada7423431f7c3742b3388eb
File size:3'770'929 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 84f098a9c9527f083ec51db310c66c6b
SHA1 hash: ceb00e68f138a2ad9ee289c10b69c6760b8bbf8f
SHA3-384 hash: be22725bbb72ae9b58c00fb084a50b05d285a1661813f65146564c24eb51cf5122ae63a2bdf3d4a5fd5ce97bd6b7e001
First seen:2022-11-24 19:54:57 UTC
Last seen:Never
Sightings:1
imphash : 66169f8db557dc9a01d7deb79a1d54fa
Create hunting rule
ssdeep : 49152:vYWoVbPlpp4xhPZT5P3uJDPLKRWvMYKSmleBhi6:gTttppy1X/SDKDtleni
TLSH : T16F06DF39A502493FC03A07745C2FA274A5FC791425BEEB87B3D84E999AF731474B834A
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:dfc04196-6c31-11ed-a71a-42010aa4000b
File name:400000.explorer.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:ditekSHen.MALWARE.Win.Ransomware.KillMBR.UNOFFICIAL
Create hunting rule
Signature:PUA.Win.Packer.Pequake-4
Create hunting rule
Signature:PUA.Win.Packer.ProtectSharewar-2
Create hunting rule
Signature:PUA.Win.Packer.ProtectSharewar-3
Create hunting rule
Signature:Win.Malware.Swisyn-7610494-0
Create hunting rule
Signature:Win.Malware.Swisyn-9942393-0
Create hunting rule
Signature:Win.Trojan.VBGeneric-6735885-0
Create hunting rule
Signature:Win.Virus.Sality-6335700-2
Create hunting rule
Signature:Win.Virus.Sality-6747602-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
TLP:TLP:WHITE
Repository:bartblaze

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.