YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash ae21912c12855176bb5cf6f6324eb4a9def04cff4d6d188feec185715396444f.

Scan Results

SHA256 hash: ae21912c12855176bb5cf6f6324eb4a9def04cff4d6d188feec185715396444f
File size:85'084 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: d6d3c50f9c46090a260b8605b9e2c2ea
SHA1 hash: 3737e122c7953386694374393337057f58f76593
SHA3-384 hash: e6fee868ed2d5d732786879e39e45fb8da6c5afc70347742d930df940cc2741b52f5d3417b08559ecdca8f658adbe445
First seen:2025-11-20 11:49:13 UTC
Last seen:Never
Sightings:1
imphash : 270438a3d704889fa9d4f8602e830925
Create hunting rule
ssdeep : 768:8LxqBt1sJw5pVNUP1/kvtbWcpmCKXHak3QIXjLZJ2bXfqQKMq+gjTAfu/MB8QKpI:TteqYQIXJJyXEv/MBK6vRel1qwE0qf
TLSH : T17B834947B69300B2D0F002F614EB5FB6DFFBAC322232A59467E27E615E75251C63D289
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:ef1e91a6-c606-11f0-adeb-42010aa4000b
File name:400000.arcimef.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:SecuriteInfo.com.Trojan.DownLoad.24167.10757.5659.UNOFFICIAL
Create hunting rule
Signature:SecuriteInfo.com.Trojan.MulDrop3.39307.UNOFFICIAL
Create hunting rule
Signature:Win.Trojan.Pincav-10022872-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
TLP:TLP:WHITE
Repository:
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.