YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash a554b4601319ab2fc2cbaeee75015e4c2c4ce6a2e0542ff93e5616a2cc6140d6.

Scan Results

SHA256 hash: a554b4601319ab2fc2cbaeee75015e4c2c4ce6a2e0542ff93e5616a2cc6140d6
File size:3'163'136 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 20dc0ccae64a5a5d947f28f28ef0f978
SHA1 hash: 91259f0785f6fedd1c48fd67caea20131ac6294b
SHA3-384 hash: 7351da103b5dadfeddcbd53e5a07029e4617e55a90d9f667ea9519cdd88993b678e063a71ac546e9a0d34678e36417fc
First seen:2026-04-27 14:53:27 UTC
Last seen:Never
Sightings:1
imphash : f676e16c67a815430fbcd6d520ece6e4
Create hunting rule
ssdeep : 98304:SrZ23AbsK6Ro022JjL2WEiVqJZWwcbl/:8JADmmxL2WEoCZTo
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:d929ec3c-4248-11f1-badc-42010aa4000b
File name:20dc0ccae64a5a5d947f28f28ef0f978
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Win32.Expiro-2.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.