Statistics
YARAify produces detailed statistics on files scanned, including associated detections - find the available statistics below.
You can also access Spamhaus's Malware Digest report, based on YARAify data:
File Scans
The chart below shows the number of file scans conducted by YARAify over the past 30 days.
Data Scanned
This chart shows the amount of data scanned in Megabytes over the past 30 days.
API requests
The illustration below documents the number of API requests over the past 30 days.
Most matching YARA rules
YARA rules that matched most on files scanned on YARAify in the past 14 days.
| Task count | YARA Rule | Author | Last match |
|---|---|---|---|
| 645'221 | RansomPyShield_Antiransomware | XiAnzheng | 2024-11-21 |
| 534'903 | SEH__vba | 2024-11-21 | |
| 400'813 | Sus_Obf_Enc_Spoof_Hide_PE | XiAnzheng | 2024-11-21 |
| 207'091 | DebuggerCheck__API | 2024-11-21 | |
| 186'736 | RANSOMWARE | ToroGuitar | 2024-11-21 |
| 125'208 | pe_detect_tls_callbacks | 2024-11-21 | |
| 101'897 | NET | malware-lu | 2024-11-21 |
| 74'555 | MD5_Constants | phoul (@phoul) | 2024-11-21 |
| 61'417 | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | malware-lu | 2024-11-21 |
| 57'186 | command_and_control | CD_R0M_ | 2024-11-21 |
| 51'973 | UPXv20MarkusLaszloReiser | malware-lu | 2024-11-21 |
| 46'356 | RIPEMD160_Constants | phoul (@phoul) | 2024-11-21 |
| 46'356 | SHA1_Constants | phoul (@phoul) | 2024-11-21 |
| 45'760 | malware_shellcode_hash | JPCERT/CC Incident Response Group | 2024-11-21 |
| 42'638 | Warp | Seth Hardy | 2024-11-21 |
Most matching ClamAV signature
ClamAV signature that matched most on files scanned on YARAify in the past 14 days.
| Task count | ClamAV Signature | Last match |
|---|---|---|
| 1'647'171 | PUA.Win.Packer.Lccwin-2 | 2024-11-20 |
| 1'091'647 | Win.Trojan.Obfus-38 | 2024-11-20 |
| 958'185 | Win.Trojan.Qukart-6874817-0 | 2024-11-20 |
| 957'115 | Win.Trojan.Padodor-10016488-0 | 2024-11-20 |
| 791'677 | Win.Malware.Qukart-6838239-0 | 2024-11-20 |
| 508'657 | Win.Malware.Midie-6847981-0 | 2024-11-20 |
| 490'121 | Win.Dropper.Ajku-10014126-0 | 2024-11-20 |
| 490'026 | Win.Trojan.Berbew-9845290-1 | 2024-11-20 |
| 483'182 | Win.Dropper.Vbclone-10036195-0 | 2024-11-20 |
| 477'781 | Win.Trojan.Barys-10005825-0 | 2024-11-20 |
| 448'669 | Win.Malware.Generickdz-10004857-0 | 2024-11-20 |
| 412'160 | Win.Malware.Midie-6848630-0 | 2024-11-20 |
| 405'609 | Win.Malware.Midie-6847894-0 | 2024-11-20 |
| 319'094 | SecuriteInfo.com.BackDoor.HangUp.43874.UNOFFICIAL | 2024-11-20 |
| 302'192 | Win.Packed.Generic-9967832-0 | 2024-11-20 |
Most seen files
Most seen files scanned by YARAify in the past 14 days.
Top dhash icon
Top dhash icon observed on files scanned by YARAify in the past 14 days.
| Task count | dhash icon | Last seen |
|---|---|---|
| 303'357 | 18b1b1b17068c880 | 2024-11-20 |
| 122'303 | 58b1b1b17068c880 | 2024-11-20 |
| 39'777 | d8d0d4d8ececece4 | 2024-11-18 |
| 20'314 | 1003873db9313e10 | 2024-11-20 |
| 10'664 | 1003873d31213f10 | 2024-11-20 |
| 8'943 | f8f0f4c8c8c8d8f0 | 2024-11-20 |
| 8'165 | 69ccd4d49696cc71 | 2024-11-20 |
| 6'877 | c883a69c94a683c8 | 2024-11-20 |
| 5'711 | 19b1b1b17068c880 | 2024-11-20 |
| 5'320 | 9919aca682a881a9 | 2024-11-20 |
| 5'000 | 30e4c0d8b686e464 | 2024-11-20 |
| 4'322 | 04ccfee2ece4a484 | 2024-11-20 |
| 3'370 | 00ccc4d0c4fc7c00 | 2024-11-20 |
| 3'315 | 71e8d4968ecc68f9 | 2024-11-20 |
| 2'635 | 18b1b1b17068c881 | 2024-11-20 |
Top imphash
Top imphash observed on files scanned by YARAify in the past 14 days.
| Task count | imphash | Last seen |
|---|---|---|
| 512'525 | 6db997463de98ce64bf5b6b8b0f77a45 | 2024-11-20 |
| 475'322 | c9246f292a6fdc22d70e6e581898a026 | 2024-11-20 |
| 461'520 | 5d6cad172c5535e4b6b6bbd246571621 | 2024-11-20 |
| 322'944 | 4dcbc0931c6f88874a69f966c86889d9 | 2024-11-20 |
| 176'635 | 46f03ef2495b21d7ad3e8d36dc03315d | 2024-11-20 |
| 40'245 | c06ddfbe3366daddf0cfd3e63c1b5390 | 2024-11-18 |
| 37'991 | 3f8d79e42b0b7cecf379b1ddce4e422a | 2024-11-20 |
| 37'687 | 87914047e74de74a89c530e3bb19409e | 2024-11-20 |
| 19'242 | dae02f32a21e03ce65412f6e56942daa | 2024-11-20 |
| 17'507 | e4742a62fda2e64b586a5b84efe3f040 | 2024-11-20 |
| 13'795 | f34d5f2d4577ed6d9ceec516c1f5a744 | 2024-11-20 |
| 12'790 | bf5a4aa99e5b160f8521cadd6bfe73b8 | 2024-11-20 |
| 9'873 | be6fa16f501de575a1d8eaaac5246ba0 | 2024-11-20 |
| 9'075 | a12d186f65c99f872323a61923ce70d8 | 2024-11-20 |
| 6'587 | 88478c1f74f94f7e1e9654193a1e02b3 | 2024-11-20 |
Top tlsh
Top tlsh observed on files scanned by YARAify in the past 14 days.
Top telfhash
Top telfhash observed on files scanned by YARAify in the past 14 days.
File Scans
The chart below shows the number of file scans conducted by YARAify over the past 12 months.
Data Scanned
This chart shows the amount of data scanned in Megabytes over the past past 12 months.
API requests
The illustration below documents the number of API requests over the past past 12 months.
Most matching YARA rules
YARA rules that matched most on files scanned on YARAify in the past 12 months.
| Task count | YARA Rule | Author | Last match |
|---|---|---|---|
| 28'263'650 | maldoc_getEIP_method_1 | Didier Stevens (https://DidierStevens.com) | 2024-11-13 |
| 28'106'670 | meth_get_eip | Willi Ballenthin | 2024-11-13 |
| 25'750'233 | QbotStuff | anonymous | 2024-08-15 |
| 12'015'323 | win_berbew_strings_dec_2023 | Matthew @ Embee_Research | 2024-11-13 |
| 5'263'920 | DebuggerCheck__API | 2024-11-21 | |
| 4'517'958 | classified | classified | 2024-09-24 |
| 3'744'219 | SEH__vba | 2024-11-21 | |
| 2'178'176 | NET | malware-lu | 2024-11-21 |
| 2'172'411 | SHA512_Constants | phoul (@phoul) | 2024-11-21 |
| 2'120'705 | malware_shellcode_hash | JPCERT/CC Incident Response Group | 2024-11-21 |
| 2'098'913 | maldoc_find_kernel32_base_method_1 | Didier Stevens (https://DidierStevens.com) | 2024-11-13 |
| 2'097'334 | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser | malware-lu | 2024-11-21 |
| 1'812'138 | UPXv20MarkusLaszloReiser | malware-lu | 2024-11-21 |
| 1'666'082 | DebuggerException__SetConsoleCtrl | 2024-11-21 | |
| 1'633'863 | DebuggerCheck__QueryInfo | 2024-11-21 |
Most matching ClamAV signature
ClamAV signature that matched most on files scanned on YARAify in the past 12 Mmonths.
| Task count | ClamAV Signature | Last match |
|---|---|---|
| 52'203'051 | PUA.Win.Packer.Lccwin-2 | 2024-11-20 |
| 34'842'605 | Win.Trojan.Obfus-38 | 2024-11-20 |
| 33'071'893 | Win.Trojan.Qukart-6874817-0 | 2024-11-20 |
| 29'015'255 | Win.Trojan.Padodor-10016488-0 | 2024-11-20 |
| 25'646'868 | Win.Malware.Qukart-6838239-0 | 2024-11-20 |
| 7'553'518 | Win.Trojan.Padodor-9877164-0 | 2024-11-20 |
| 6'819'000 | Win.Trojan.Berbew-9845290-1 | 2024-11-20 |
| 6'259'065 | SecuriteInfo.com.BackDoor.HangUp.43874.UNOFFICIAL | 2024-11-20 |
| 4'172'735 | Win.Packed.Razy-10010080-0 | 2024-11-20 |
| 3'801'713 | Win.Trojan.Razy-10016933-0 | 2024-11-20 |
| 3'629'821 | Win.Packed.Lazy-10005437-0 | 2024-11-20 |
| 3'590'662 | Win.Trojan.Berbew-10013977-0 | 2024-11-20 |
| 3'316'515 | Win.Trojan.Crypted-29 | 2024-11-20 |
| 3'294'478 | Win.Trojan.Crypted-30 | 2024-11-20 |
| 2'827'017 | Win.Malware.Renos-10003934-0 | 2024-11-20 |
Most seen files
Most seen files scanned by YARAify in the past 12 months.
Top dhash icon
Top dhash icon observed on files scanned by YARAify in the past 12 months.
| Task count | dhash icon | Last seen |
|---|---|---|
| 1'515'463 | 18b1b1b17068c880 | 2024-11-20 |
| 607'461 | d8d0d4d8ececece4 | 2024-11-18 |
| 511'192 | 69ccd4d49696cc71 | 2024-11-20 |
| 490'740 | 1003873db9313e10 | 2024-11-20 |
| 415'463 | 58b1b1b17068c880 | 2024-11-20 |
| 216'602 | 818da080a0a0a0a2 | 2024-11-20 |
| 215'474 | 1003873d31213f10 | 2024-11-20 |
| 123'981 | 00ccc4d0c4fc7c00 | 2024-11-20 |
| 123'059 | 9919aca682a881a9 | 2024-11-20 |
| 120'291 | 5ab3a5b332c482a0 | 2024-11-20 |
| 118'752 | b298acbab2ca7a72 | 2024-11-20 |
| 118'455 | 71e8d4968ecc68f9 | 2024-11-20 |
| 108'522 | 526e32661e3a2a10 | 2024-11-20 |
| 80'557 | 04ccfee2ece4a484 | 2024-11-20 |
| 52'247 | f8f0f4c8c8c8d8f0 | 2024-11-20 |
Top imphash
Top imphash observed on files scanned by YARAify in the past 12 months.
| Task count | imphash | Last seen |
|---|---|---|
| 15'998'101 | 6db997463de98ce64bf5b6b8b0f77a45 | 2024-11-20 |
| 10'618'667 | 4dcbc0931c6f88874a69f966c86889d9 | 2024-11-20 |
| 9'694'194 | 46f03ef2495b21d7ad3e8d36dc03315d | 2024-11-20 |
| 6'449'007 | c9246f292a6fdc22d70e6e581898a026 | 2024-11-20 |
| 2'323'959 | e4742a62fda2e64b586a5b84efe3f040 | 2024-11-20 |
| 2'018'113 | 5d6cad172c5535e4b6b6bbd246571621 | 2024-11-20 |
| 1'020'496 | 87914047e74de74a89c530e3bb19409e | 2024-11-20 |
| 786'130 | 91f4b88d25daa33c7443253d9beb1bb3 | 2024-11-20 |
| 717'746 | 3f8d79e42b0b7cecf379b1ddce4e422a | 2024-11-20 |
| 539'906 | 2c2ad1dd2c57d1bd5795167a7236b045 | 2024-11-20 |
| 433'091 | a3df475500e5e30f4680b397c2ee13f1 | 2024-11-20 |
| 385'712 | f34d5f2d4577ed6d9ceec516c1f5a744 | 2024-11-20 |
| 344'107 | c06ddfbe3366daddf0cfd3e63c1b5390 | 2024-11-18 |
| 272'742 | 1a611a7df1f3828b0157c4725145a721 | 2024-11-18 |
| 254'248 | dae02f32a21e03ce65412f6e56942daa | 2024-11-20 |
Top tlsh
Top tlsh observed on files scanned by YARAify in the past 14 months.
Top telfhash
Top telfhash observed on files scanned by YARAify in the past 12 months.