YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 42806f4bc02af126669dd139b7fe328d296054738ae1b363f432e9ae6eb08f6a.

Scan Results

SHA256 hash: 42806f4bc02af126669dd139b7fe328d296054738ae1b363f432e9ae6eb08f6a
File size:1'489'052 bytes
File download: Original
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash: 3a5757710213b11dcd47e5feceab7734
SHA1 hash: b5af39798cc45950aca5bf6bd0c2d46c24f26400
SHA3-384 hash: 8f583dd1092ce55de6b0316d45d22ca652dc23726dfab00f612667ea4187190538eab68e3ef0a54ab5d4a10f5612e079
First seen:2025-11-20 23:57:21 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 24576:Pz1j/d4HCtiuo9WTmG2eX1/HsO5ulEAz3e+C5YAi5irq2SmOnh6BRMghj0:tdk9kXtlBulROjCAi5irenGxhA
TLSH : T158651360C9C9FF5BEBCE5078D25638186BE51DFC9501682A7238E4E7E5CB84ECB38548
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:a7884374-c66c-11f0-adeb-42010aa4000b
File name:3a5757710213b11dcd47e5feceab7734
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
TLP:TLP:WHITE
Repository:karttoon
Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/
TLP:TLP:WHITE
Repository:
Rule name:TA505_Maldoc_21Nov_2
Create hunting rule
Author:Arkbird_SOLG
Description:invitation (1).xls
Reference:https://twitter.com/58_158_177_102/status/1197432303057637377
TLP:TLP:WHITE
Repository:StrangerealIntel
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:TLP:WHITE
Repository:CD-R0M

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.