YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 9f51fb11e40e276ab9d01a08e6105718a384ebda77784ebfb02222cd5c1bc659.

SHA256 hash:	9f51fb11e40e276ab9d01a08e6105718a384ebda77784ebfb02222cd5c1bc659
File size:	344'064 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	5703ea1e841c10120c517953cc8f25dd
SHA1 hash:	08f6eab7516d3f5c87b8ea48c2a5a28238230bf9
SHA3-384 hash:	f73c6c867663c4521a1893f8ffc690e13a1413ff250fc322f259579ba5acc7640acf90a7e24912f0eacef4abd35eb85a
First seen:	2026-10-10 06:43:57 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	6144:dVy9PBnh7duR8+EdXqH3bOsOBmzjhqoS+40MYB:qjh28HkL3OWhqoSGr
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	62f98c968b89e163 Create hunting rule

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
TLP:	TLP:WHITE

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_Unknown_ForgeAuto_30f84f37 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-10 06:43:57 UTC Static: 14 Unpacker: 0 ClamAV: 0