YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash f3fa909fafd92cac8605d8c49274040840767ba7c1191243752dcf7699a27ea3.

Scan Results

SHA256 hash: f3fa909fafd92cac8605d8c49274040840767ba7c1191243752dcf7699a27ea3
File size:7'593'984 bytes
File download: Original
MIME type:application/x-dosexec
MD5 hash: a7718fcac9b611c81569cae8b7056754
SHA1 hash: ac6c30061e8083d42fae3a9148dbfbc43ed9b87b
SHA3-384 hash: ef847bddf0dcaf71fecc7f87ead4a234b2ce2b4a20a9cbca357d66354de1a35d892ca78aebeaff6591b183ab35043f3e
First seen:2023-01-25 09:32:06 UTC
Last seen:Never
Sightings:1
imphash : baa93d47220682c04d92f7797d9224ce
Create hunting rule
ssdeep : 196608:AdviZkacZynhsUxw3YOc73Njr6Obzzx4v:Mpye3zG6Ojx
TLSH : T16976AF623A02C2BFCCE211B144BBDE4A556C4AB54B3865C3A96C393E3E75CC31E7195B
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:22218a03-9c93-11ed-98c2-42010aa4000b
File name:400000.Runner.exe
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:MiscreantPunch.SingleXOR.EXE.125.UNOFFICIAL
Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
TLP:TLP:WHITE
Repository:YARAify
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
TLP:TLP:WHITE
Repository:YARAify
Rule name:QbotStuff
Create hunting rule
Author:anonymous
TLP:TLP:WHITE
Repository:MalwareBazaar

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.