YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash a955a0c03f92aac30ca2b9213e74f1ab098d5ab13dfaf73d364089074ff96eff.

Scan Results


SHA256 hash: a955a0c03f92aac30ca2b9213e74f1ab098d5ab13dfaf73d364089074ff96eff
File size:477'804 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 655e554486c156fe63273d858f0a9a97
SHA1 hash: b914b2b424d8081f7e6002fddd685598e14db566
SHA3-384 hash: a9bf152b8c50b9334288636d99a022f9b66c230f49039611c976c879796fdd22d20dc7681fdbcb2d573729383d631e91
First seen:2022-11-24 19:50:13 UTC
Last seen:Never
Sightings:1
imphash : 8715b94d21f3d885b079e13feeb899c1
ssdeep : 6144:vY+32WWluqvHpVmXWEjFJRWci+WUd20Or+UU5EYCTvaBju4z:QnWwvHpVmXpjJIUd2EUusvalxz
TLSH : T175A4293AEB20B216FA578C7A78294E1A15283C3561119E4BB3926B4D34767C3F9F434F
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:35f70c99-6c31-11ed-a71a-42010aa4000b
File name:400000.lsass.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Lmvwkprng-6742707-0
Signature:Win.Malware.Lmvwkprng-6742708-0
Signature:Win.Malware.Lmvwkprng-6803869-0
Signature:Win.Malware.Moonlight-9890813-0
Signature:Win.Malware.Moonlight-9890875-0
Signature:Win.Malware.Moonlight-9919382-0
Signature:Win.Malware.Moonlight-9919383-0
Signature:Win.Malware.Moonlight-9934254-0
Signature:Win.Malware.Moonlight-9934996-0
Signature:Win.Packed.Moonlight-9934265-0
Signature:Win.Packer.VbPack-0-6334882-0
Signature:Win.Trojan.Moonlight-9881795-0
Signature:Win.Worm.Moonlight-9775620-0
Signature:Win.Worm.Moonlight-9779178-0
Signature:Win.Worm.Ulise-9778387-0
Signature:Win.Worm.Ulise-9779043-0

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:INDICATOR_EXE_Packed_MPress
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:ditekshen
Rule name:meth_get_eip
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:yaraify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.