YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash c7cea43ee93c3445af4d1d98b5fb7c78f084b6dc59c2133598e09fd89e6c898f.

Scan Results


SHA256 hash: c7cea43ee93c3445af4d1d98b5fb7c78f084b6dc59c2133598e09fd89e6c898f
File size:390'001 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 8eec31ed88b36ff99c7ab65c6d6333bd
SHA1 hash: 793e0ba1a92763b23c5a25c358e6329211465e1e
SHA3-384 hash: 0d62cc6e53aa587d2612b81d9716de7677a161259d6c2c45c3269ff3d1a70953b803d397b992dd60c2b12ef5a28ee2d7
First seen:2023-01-25 09:41:47 UTC
Last seen:Never
Sightings:1
imphash : 286eac8d8bd4ba11370ca9c14bebe686
ssdeep : 6144:XWE3IrvTn5BIQs4D7ems0gQPPai3jNrp9Co5:XWE3IrT5+Qs4D7emLgkCwNzCo5
TLSH : T19384C713E730ACA6F428627662BF0739BD74D3513CB08527FBA0CEB15CA56624B57A0D
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks


You can browse the 10 most recent tasks associated with this file blow.

Task Information


Task ID:7c48ddef-9c94-11ed-98c2-42010aa4000b
File name:400000.f82ef684-d99e-4262-8fce-79747212832c.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results


The file matched the following open source and commercial ClamAV rules.

Signature:Win.Dropper.Tiggre-9845940-0
Signature:Win.Dropper.Tinba-9943147-2

YARA Results


Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:command_and_control
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:INDICATOR_EXE_Packed_MPress
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
TLP:TLP:WHITE
Repository:ditekshen
Rule name:MALWARE_Win_BlackMoon
Author:ditekSHen
Description:Detects executables using BlackMoon RunTime
TLP:TLP:WHITE
Repository:ditekshen
Rule name:meth_get_eip
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:yaraify
Rule name:TeslaCryptPackedMalware
TLP:TLP:WHITE
Repository:malware-bazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files


The following files could be unpacked from this sample.