YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash b1776813dfa0ce39b7b4d0dda97ad99b5b802e0256d9cecf19328fbe2de3614c.

SHA256 hash:	b1776813dfa0ce39b7b4d0dda97ad99b5b802e0256d9cecf19328fbe2de3614c
File size:	618'496 bytes
File download:	Original
MIME type:	application/vnd.microsoft.portable-executable
MD5 hash:	7f5a0dcd00950aba57b642ade83410a0
SHA1 hash:	8d3fa86a135a47e1157e66741c352771baa9ce52
SHA3-384 hash:	aa0d3eb9ce2ebcbdaa652b3a688ddb62f79e5c1cb500b52d5fc969b7b941da8fe2e388faccd8cb4515cb06e51c984db1
First seen:	2026-10-31 09:55:18 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	3072:W+mzq0IkvZF1dx41aXdOpsA2WCc3VwKurQf:GG0IkvX1d5XddcYrE
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	Detects command variations typically used by ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	pe_no_import_table Create hunting rule
Author:
Description:	Detect pe file that no import table
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	VIGIA_RemcosRAT_067b3e47 Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	Remcos RAT indicators with corroborated family detection and original-sample coverage
Reference:	https://vigia.bisite.es/
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WIN_SHADOW_UNPACKED Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-10-31 09:55:18 UTC Static: 15 Unpacker: 0 ClamAV: 0