YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash a0d42b2cc4662b8aa652d91be23d87839445ac2e171d6dfa55b4e4764037c697.

Scan Results


SHA256 hash: a0d42b2cc4662b8aa652d91be23d87839445ac2e171d6dfa55b4e4764037c697
File size:477'542 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 6d86d6a4c031d9576e68cd1e1833f6eb
SHA1 hash: dd667661029db70e234d28c63e843343af96f5bd
SHA3-384 hash: dc1650ce460cb3dd0706d885a33ff3b71ce8ecb20a9e71fac328d99c25cceb1f9237a04b33188907d5628714cdbfb094
First seen:2022-11-24 19:50:11 UTC
Last seen:Never
Sightings:1
imphash : 2126fd947b23c689cf2a3fa4e77b5382
ssdeep : 6144:2Y+32WWluqvHpVmXWEjFJRWci+WUd20Ar+UU5EYCTvaBju4z:tnWwvHpVmXpjJIUd2uUusvalxz
TLSH : T1ADA4283AEB20B116FA578C7A78294E1B15283C3562119E4BB3926B4D34766C3F9F434F
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:3508415a-6c31-11ed-a71a-42010aa4000b
File name:400000.service.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Lmvwkprng-6742707-0
Signature:Win.Malware.Lmvwkprng-6742708-0
Signature:Win.Malware.Lmvwkprng-6803869-0
Signature:Win.Malware.Moonlight-9890813-0
Signature:Win.Malware.Moonlight-9890875-0
Signature:Win.Malware.Moonlight-9919382-0
Signature:Win.Malware.Moonlight-9919383-0
Signature:Win.Malware.Moonlight-9934254-0
Signature:Win.Malware.Moonlight-9934996-0
Signature:Win.Packed.Moonlight-9934265-0
Signature:Win.Packer.VbPack-0-6334882-0
Signature:Win.Trojan.Moonlight-9881795-0
Signature:Win.Worm.Moonlight-9775620-0
Signature:Win.Worm.Moonlight-9779178-0
Signature:Win.Worm.Ulise-9778387-0
Signature:Win.Worm.Ulise-9779043-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:INDICATOR_EXE_Packed_MPress
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:ditekshen
Rule name:meth_get_eip
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:yaraify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.