YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash ff8c6bbf62d1247ea097a2e3f97a8babaf050cf32bf84fc8c5add24ed53fa57a.

Scan Results

SHA256 hash: ff8c6bbf62d1247ea097a2e3f97a8babaf050cf32bf84fc8c5add24ed53fa57a
File size:32'915'456 bytes
File download: Original
MIME type:application/octet-stream
MD5 hash: cd48a6aa55b4fad7e8fce8b6d75bba89
SHA1 hash: 1f8e5e6efe3c6f13a0d1982c24661062ef587fa2
SHA3-384 hash: d6553a8540026c47035766f9eed78d7826e636d6afc3d190f30da854bcbaee28c072873ed0f5990d80586bc590923f6b
First seen:2023-01-25 09:33:27 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 393216:Wf7aZZIDjlXCwzG56TTQao4wzmZ6znk6cItW+RqD3cvEt9DDJ6b6kSMKNT55QBQN:
TLSH : T1A877001459FB518BA3E3E9711FDCA97E8A8AA163800C35761004E32B7B5DE74DA4FB34
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:52ed924a-9c93-11ed-98c2-42010aa4000b
File name:14440000.shc
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
TLP:TLP:WHITE
Repository:MalwareBazaar
Rule name:SUSP_Double_Base64_Encoded_Executable
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
TLP:TLP:WHITE
Repository:Neo23x0
Rule name:SUSP_Double_Base64_Encoded_Executable_RID34CC
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
TLP:TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.