YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 9ccf2ae15bd3c74274ff23adabe8e13b7029fb6b3ed3ae9e07f23fb003c04d94.

Scan Results

SHA256 hash: 9ccf2ae15bd3c74274ff23adabe8e13b7029fb6b3ed3ae9e07f23fb003c04d94
File size:506'632 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 12a23741b668b2d785f74f40e2806c80
SHA1 hash: 700bb98de1ea10ec5c3fc8c9983ebeb8135f1879
SHA3-384 hash: 806604547655b0c02a3661b369c94f33849e874ea666ef43d6a1b8197a50a86078efaac7c2e7f152bad5cb7d29f74e84
First seen:2025-11-20 23:51:40 UTC
Last seen:Never
Sightings:1
imphash : 4cca3a40d43897162b45e7061f7a7c4e
Create hunting rule
ssdeep : 6144:lBDHmrz4niNy8o3Zp/TWt+g4RQTDUBO8/2vh+ziDV8mL6TBRpZUv:3DHmoniNy8L8g4RgoBO8/2vhDXL6TfPM
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 1af9c8ccf68accf0
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:dc51dd66-c66b-11f0-adeb-42010aa4000b
File name:12a23741b668b2d785f74f40e2806c80
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Downloader.Delf-9856618-0
Create hunting rule
Signature:Win.Downloader.Dibik-9856236-1
Create hunting rule
Signature:Win.Dropper.Tinba-9943147-2
Create hunting rule
Signature:Win.Keylogger.Delf-10033046-0
Create hunting rule
Signature:Win.Keylogger.Delf-10033629-0
Create hunting rule
Signature:Win.Keylogger.Delf-9629510-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Borland
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
TLP:TLP:WHITE
Repository:
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:NET
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:TeslaCryptPackedMalware
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.