YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash b2dc8df314f32df5d8a3c72fca47af33a36b8bb1c9141817383351e3133d4c51.

Scan Results

SHA256 hash: b2dc8df314f32df5d8a3c72fca47af33a36b8bb1c9141817383351e3133d4c51
File size:208'596 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 12d5049493e1c02ea3902405283c2fb9
SHA1 hash: 2e1754fa3ff569c196b34d65e6f275ecfa962955
SHA3-384 hash: 989f4415cae7246c29e48917c768e1bb24ae222021975c4cb05f3f750f963fabe6ddab7e12aa36f37703aae614a6c701
First seen:2026-04-12 17:02:50 UTC
Last seen:Never
Sightings:1
imphash : 9a40b556f04c6c6d3d61394c56be6bd5
Create hunting rule
ssdeep : 3072:M1abGWGT2TK1dbzlF9OVtSZjCw8geIr/QAuCgNVfpxICuQsKUIZn:9bpGtfoVtScw2RCgrzItQB
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:7050bc4f-3691-11f1-bfeb-42010aa4000b
File name:12d5049493e1c02ea3902405283c2fb9
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Dacic-10014176-0
Create hunting rule
Signature:Win.Malware.Fasong-9910797-0
Create hunting rule
Signature:Win.Malware.Fasong-9918317-0
Create hunting rule
Signature:Win.Worm.Fasong-5
Create hunting rule
Signature:Win.Worm.Fasong-6840784-0
Create hunting rule
Signature:Win.Worm.Fasong-9753929-0
Create hunting rule
Signature:Win.Worm.Fasong-9753931-0
Create hunting rule
Signature:Win.Worm.Fasong-9753932-0
Create hunting rule
Signature:Win.Worm.Fasong-9806395-0
Create hunting rule
Signature:Win.Worm.Fasong-9908424-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Borland
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:UPXProtectorv10x2
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.