YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash ac40d89b4f5dc615dca163a60dee8814e51694474a3789b67a8624094300e9c2.

Scan Results

SHA256 hash: ac40d89b4f5dc615dca163a60dee8814e51694474a3789b67a8624094300e9c2
File size:21'504 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: bda7a7fba63ddfa06dc37744fcc3c832
SHA1 hash: f2454ce3cec02fb3aa6c908846b1e345efe8167b
SHA3-384 hash: 9d42b0b3c76400d5213b12890ef49ebc09b13e01b2be3f73f824e23d8cc403cad0cdace358ba1424b53fbe23c0512c0a
First seen:2025-11-21 02:59:18 UTC
Last seen:Never
Sightings:1
imphash : 71cab448d584f8340afa56a3a6a3d8a9
Create hunting rule
ssdeep : 384:MBymhCDdXxbsbBtao4UOf05qFgs+saeqVn:MBVhChXxbsbBtao4UOf0UN9aeu
TLSH : T174A29452B385DE63FC561E70A437A6C041B6ECB06F2206DE77A536DCD8B33827463252
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon : c8dc988898b8a490
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:12805730-c686-11f0-adeb-42010aa4000b
File name:400000.lcica.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
TLP:TLP:WHITE
Repository:
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.