YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 9919c1e0e512929ed4dc96a8ae72b0994091cac753efaeca0200c244828195f6.

Scan Results


SHA256 hash: 9919c1e0e512929ed4dc96a8ae72b0994091cac753efaeca0200c244828195f6
File size:1'299'644 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: da0876ed307bc7440140cecdefa86658
SHA1 hash: 0b9a7dbc707f20a9518f56778737d0504a09e992
SHA3-384 hash: 2ad69dc6183414553ace05de9c17612eb5f8df4d6e4a38af6fcc5dedc0d8ddfe0cc363b0f2416ea3d8b1e4ea32bde7e0
First seen:2023-01-25 09:39:14 UTC
Last seen:Never
Sightings:1
imphash : 09db42d59125f1ac2231c44e72f06181
ssdeep : 24576:fZQTFFHwX3ClT4aqgFQRh2ruZ5XaEcvQDcFG/h2FyYOjI3WJSfN:RkUClTiA8Hja/4rPnI3D
TLSH : T12455F166F6C1C437E1622A3D9C97C2A4A43ABE525D3C144B7BF83F0C4E7929165363CA
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:212621ee-9c94-11ed-98c2-42010aa4000b
File name:400000.3a2fa503-c6a3-4c39-957a-a663e638dd5.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Fugrafa-9797367-0
Signature:Win.Malware.Reconyc-9792177-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:shellcode
Author:nex
Description:Matched shellcode byte patterns
TLP:TLP:WHITE
Repository:malware-bazaar
Rule name:SUSP_XORed_Mozilla
Author:Florian Roth
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_Mozilla_RID2DB4
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
TLP:TLP:WHITE
Rule name:SUSP_XORed_URL_in_EXE
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
TLP:TLP:WHITE
Rule name:win_biodata_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
TLP:TLP:WHITE
Repository:malpedia

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.