YARAify Task Results

YARAify scan results for task ID bf198191-fb0b-11ec-9250-42010aa4000b.

Task ID:	bf198191-fb0b-11ec-9250-42010aa4000b
Task parameters:	clamav_scan:	True
	unpack:	True
	share_file:	True
Submission time:	2022-07-03 20:07:21 UTC
Scan time:	Scan took 12 seconds
File name:	malware_in_themes_css.php
File size:	10'968 bytes
File download:	Original
MIME type:	text/html
SHA256 hash:	4e7a018d007a02dabdc93418b61bf299326d6480ecf5938ca2793a6b584a7b09
MD5 hash:	2bb4e73b2f6133182d851396aee85908
SHA1 hash:	78cf77a62eb2d8814ab32ecce5aa6ea7e18757cf
SHA3-384 hash:	c59dd90bba7d0baea32865390f57c01dbc48e8e5d40db35699539249181389d89d9f37ef2ca967cd02d11fa3b21a038d
First seen:	2022-07-03 20:07:20 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	192:e0h0Lspty0moQput1VLsp+0moQpIb3ALsp+0moQpIv:eegcywtX9ybU9yv
TLSH :	T1A632103A76DB598E6436F07C4E55A159F67AC22B10248F467D2C80D47F307B04EE6B8E Create hunting rule
telfhash :	n/a
dhash icon :	n/a

The following YARA rules matched on the file (static analysis).

Rule name:	webshell_php_generic_eval Create hunting rule
Author:	Arnim Rupp
Description:	Generic PHP webshell which uses any eval/exec function in the same line with user input
TLP:	TLP:WHITE
Repository:	Neo23x0

The following YARA rules matched on the unpacked file.

No matches

The file matched the following open source and commercial ClamAV rules.

Signature:	{HEX}php.malware.magento.598.UNOFFICIAL Create hunting rule

Signature:	YARA.eval_post.UNOFFICIAL Create hunting rule