YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash def62e939d02f629306dd59bc738fa4db19a86df31e6d2bd66a12902255ff8db.

Scan Results

SHA256 hash: def62e939d02f629306dd59bc738fa4db19a86df31e6d2bd66a12902255ff8db
File size:13'182'024 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 6b452a37bff6cbbd90d67f1cd942a13c
SHA1 hash: 2f3a9ce87fb361e6a10461bd766448faf0913267
SHA3-384 hash: ba7159602c38eb9178e5dc3fce6234a19f82d4a49b95d2bbcdc4dc4053614fb121359a798defd234fece8c0767751c33
First seen:2026-07-19 11:11:23 UTC
Last seen:Never
Sightings:1
imphash : 6245258f13c7e214170da2412ba4639d
Create hunting rule
ssdeep : 98304:9av5MwDq/uVcZgVPfuOJs+jC4Gajd9DMUQoqSk9O+Z8ZzDld/zh+DtR6RL:9abUOJjTbZnqcw8p45c
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon : 0dd4d4ccccd4d409
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:942ab34c-8362-11f1-ad5e-42010aa4000b
File name:6b452a37bff6cbbd90d67f1cd942a13c
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:YARA.DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
TLP:TLP:WHITE
Repository:
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
TLP:TLP:WHITE
Repository:CD-R0M
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:classified
Author:classified
Description:classified
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
TLP:TLP:WHITE
Repository:YARAify
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:TLP:WHITE
Repository:YARAify
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
TLP:TLP:WHITE
Repository:YARAify
Rule name:INDICATOR_RMM_PDQConnect_Agent
Create hunting rule
Author:ditekSHen
Description:Detects PDQ Connect Agent. Review RMM Inventory
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:INDICATOR_RMM_PDQConnect_Agent_CERT
Create hunting rule
Author:ditekSHen
Description:Detects PDQ Connect Agent by (default) certificate. Review RMM Inventory
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
TLP:TLP:WHITE
Repository:
Rule name:classified
Author:classified
Description:classified
Reference:classified
TLP :TLP:GREEN
Rule name:pe_detect_tls_callbacks
Create hunting rule
Author:
TLP:TLP:WHITE
Repository:YARAify
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
TLP:TLP:WHITE
Repository:
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
TLP:TLP:WHITE
Repository:
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
TLP:TLP:WHITE
Repository:
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
TLP:TLP:WHITE
Repository:silence-is-best
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:TLP:WHITE
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
TLP:TLP:WHITE
Repository:
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
TLP:TLP:WHITE
Repository:
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
TLP:TLP:WHITE
Repository:YARAify
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
TLP:TLP:WHITE
Repository:YARAify
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
TLP:TLP:WHITE
Repository:YARAify
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.