YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash ee223ccde03876cb64b99abd9e5365a9a539330d982f25c20071540be259784b.

Scan Results

SHA256 hash: ee223ccde03876cb64b99abd9e5365a9a539330d982f25c20071540be259784b
File size:89'415 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: 11f5595e12fca4d3d97803c7828df7fb
SHA1 hash: 430db7fda44ac51a28da95d00ff4cf55e50e7b5a
SHA3-384 hash: b287a3b0dde81d8fbde475507d7cc5a4dd50c367fea5e5f71def72b3154e13500265b4a587c0d4984f399ef215c8cbe9
First seen:2025-11-21 02:48:46 UTC
Last seen:Never
Sightings:1
imphash : e0ce5ef0bca7a89405f5a38e31b7697b
Create hunting rule
ssdeep : 1536:uAxNL7IX5TSB4ZbW3OBX40ufS1MfCqK6L+sbH+SkfNBB4:vHI0B4Zq8X4I66/AljjqNk
TLSH : T1A293F2925760C066C9232531012D1F7AB377DF423BF603A213EC6149FBA5C3769B5AD4
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon : 3496f4b0b4f4be82
Create hunting rule

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:99de7234-c684-11f0-adeb-42010aa4000b
File name:11f5595e12fca4d3d97803c7828df7fb
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:PUA.Win.Packer.Chinaprotect-1
Create hunting rule
Signature:PUA.Win.Packer.RlpackFullediti-3
Create hunting rule
Signature:PUA.Win.Packer.RlpackFullediti-5
Create hunting rule
Signature:Win.Dropper.Gh0stRAT-7414189-0
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:CN_Honker_Webshell
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Sample from CN Honker Pentest Toolset - file Webshell.exe
Reference:Disclosed CN Honker Pentest Toolset
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:CN_Honker_Webshell_RID2DFD
Create hunting rule
Author:Florian Roth
Description:Sample from CN Honker Pentest Toolset - file Webshell.exe
Reference:Disclosed CN Honker Pentest Toolset
TLP:TLP:WHITE
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:INDICATOR_EXE_Packed_RLPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with RLPACK
TLP:TLP:WHITE
Repository:diˈtekSHən
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
TLP:TLP:WHITE
Repository:
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
TLP:TLP:WHITE
Repository:YARAify
Rule name:RLPackFullEditionV11Xap0x
Create hunting rule
Author:malware-lu
TLP:TLP:WHITE
Repository:

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.