🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash eb7540d238e8356b090715ae54ef818878e331b5469169f8bcb7cdc5b4fa8d43.

Scan Results

SHA256 hash: eb7540d238e8356b090715ae54ef818878e331b5469169f8bcb7cdc5b4fa8d43
File size:163'840 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 8774f3e8940370afd57aef2c250ffa82
SHA1 hash: d664e045d342638968419c40be3098ac08cc4cb7
SHA3-384 hash: 704ee582812fe56b3778a83655d1a103daef3743a0c964c3c93466f2f874167f78cb9fc282270eca1feaf1b71f505214
First seen:2026-09-09 02:35:10 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 3072:XfFSAE/XgZGDhjVggf9PmdJtqGwXsdZy:+Z9PmdJtnwXsd
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:13f573f5-abf7-11f1-b69f-42010aa4000b
File name:10000000.wayodnlod.aow
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:Win.Malware.Palevo-9918389-0
Create hunting rule
Signature:Win.Worm.Razy-9969785-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CMD_Ping_Localhost
Create hunting rule
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:TLP:WHITE
Repository:YARAify
Rule name:dgaaga
Create hunting rule
Author:Harshit
Description:Detects suspicious PowerShell or registry activity
TLP:TLP:WHITE
Repository:YARAify
Rule name:INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent
Create hunting rule
Author:ditekSHen
Description:Detects executables containing base64 encoded User Agent
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:TLP:WHITE
Repository:YARAify
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
TLP:TLP:WHITE
Repository:YARAify
Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
TLP:TLP:WHITE
Repository:CAPE
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
TLP:TLP:WHITE
Repository:YARAify
Rule name:classified
Author:classified
Description:classified
TLP :TLP:AMBER

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.