YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash d9a5e52bf657815ab2dc22c02b90456a0431864d55b6bf73a4bf1a94abb52bb0.

Scan Results

SHA256 hash: d9a5e52bf657815ab2dc22c02b90456a0431864d55b6bf73a4bf1a94abb52bb0
File size:2'319'544 bytes
File download: Original Unpacked
MIME type:application/x-dosexec
MD5 hash: 042bf349f9b38e1241f1bef3a2f0b17e
SHA1 hash: 8801cd4ac28ce5bf6902ea0963553db23984d6ec
SHA3-384 hash: 1e922e3635ea45cd03dee0eb730e503d32d6dab71932740e6fe3fa39b1fb3da54c5c208c3990696a8f98c7af5e412ee6
First seen:2025-11-21 02:55:03 UTC
Last seen:Never
Sightings:1
imphash : b34f154ec913d2d2c435cbd644e91687
Create hunting rule
ssdeep : 1536:K+nQc1w4vuFv0hEe2+bO0DEtauQ9s48vxFI10ElL5Rq6qSVFp:hn77v00hEoDEtaul48vxFI1Ndp
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : c6869aeaea9ae6d0
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:7a5206a7-c685-11f0-adeb-42010aa4000b
File name:042bf349f9b38e1241f1bef3a2f0b17e
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.