YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash ad53b8a87245bb6b44cb2b433f40a297f64d99c2af0bc2e285cb629f0e99343a.

SHA256 hash:	ad53b8a87245bb6b44cb2b433f40a297f64d99c2af0bc2e285cb629f0e99343a
File size:	175'104 bytes
File download:	Original
MIME type:	application/vnd.microsoft.portable-executable
MD5 hash:	8f8ff8d66b1bb96d6d6297288a0f49f3
SHA1 hash:	6a8807c686f851e3f321e17da3b4dc37489f6cac
SHA3-384 hash:	4ba257bc365a383a8f9fc20546fd32dd97b1a1d07f44be0690148c5b985a574f0f510b47e2ca0d0624e1f659ca5a5d2a
First seen:	2026-10-30 20:05:48 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	3072:ONRrWgsD+ZKHhfWrfI10PKucQd997zH/4KUNkHh9Jo:TqZ4h4fIqPWQdv4KUN2hLo
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MAL_packer_lb_was_detected Create hunting rule
Author:	0x0d4y
Description:	Detect the packer used by Lockbit4.0
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	pe_detect_tls_callbacks Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-30 20:05:48 UTC Static: 7 Unpacker: 0 ClamAV: 0