YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 964f4f0ea52f15ae32d13030332ec22c771bcaec82cf67d068119ddd06bc3669.

SHA256 hash:	964f4f0ea52f15ae32d13030332ec22c771bcaec82cf67d068119ddd06bc3669
File size:	544'768 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	eb2c6e35fb031055f879b5559c4e5f0d
SHA1 hash:	6582ad80f744ba8e35c41fd8ccaa77850855ba37
SHA3-384 hash:	62fd73678c0a82d37edab84408f65c97dfc3a63ccd63a0d08c26471aca95e21700838a1c62d6a9d33c1f84b9bbdacf1d
First seen:	2026-10-10 07:02:06 UTC
Last seen:	Never
Sightings:	1
imphash :	518e2567df5a710e1a04c448251c4580 Create hunting rule
ssdeep :	12288:ebLuzQ9DkoFfSILx0wNOLjeWnOYhLAgUUJg7+yVAR+CiS3OAbVoBDlh7lzNwE:ebK89DhXBcYCitAbVoF
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MULTI_Malware_Unknown_ForgeAuto_4f67e0b3_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MULTI_Malware_Unknown_ForgeAuto_57b77e4a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MULTI_Malware_Unknown_ForgeAuto_e38c53ae_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (archive, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants
TLP:	TLP:WHITE
Repository:

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-10 07:02:07 UTC Static: 8 Unpacker: 0 ClamAV: 0