YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash caa26cf0d09a8947e62bf38113836c284a5aa08b2437f7ec32accde3d182da0e.

SHA256 hash:	caa26cf0d09a8947e62bf38113836c284a5aa08b2437f7ec32accde3d182da0e
File size:	5'102'648 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	3e67805beac1610f0c3a95f3cdc6d31f
SHA1 hash:	497ec93a238fe498f3ae32f60f8fc0fc32c554f4
SHA3-384 hash:	1f82d57cdbb2a76c47b66422ddda49b0496ca32d8d3ec5cfc3b94a76c0d4b33e418ca952fef3bad61367d71e49850225
First seen:	2025-11-20 23:51:16 UTC
Last seen:	Never
Sightings:	1
imphash :	dae02f32a21e03ce65412f6e56942daa Create hunting rule
ssdeep :	12288:Nf3DCTxf3DC8HVravMTWwhf6Uo+g9vXAe+f3DCMlo70pmm9gCJ4f9f6kwnYr:9wZzBjo9l2lNpmm9R4fhSnYr
TLSH :	T1CC368BF8FD908B16C4107275EEF6E7452EA8FADB1E13AA1536DC45EF25412ECE2B0940 Create hunting rule
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants
TLP:	TLP:WHITE
Repository:

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win32_dotnet_obfuscate Create hunting rule
Author:	Reedus0
Description:	Rule for detecting .NET obfuscated malware
TLP:	TLP:WHITE

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2025-11-20 23:51:16 UTC Static: 3 Unpacker: 0 ClamAV: 0