YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 610ceeb15403a05a63d9c82cef56115b596fd1e96d7a1944d86367f47e34bd55.

SHA256 hash:	610ceeb15403a05a63d9c82cef56115b596fd1e96d7a1944d86367f47e34bd55
File size:	1'196'706 bytes
File download:	Original
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash:	5d78bc16349ed53068063a7f33ee89e2
SHA1 hash:	50a6ca68500be3a8c694ae7401946d0ca16d4dfa
SHA3-384 hash:	44eed76b2a4ad7d11e6fe62518b824080c70bb44756f345b9edf5519521ccd036d3420f7e2bd3ecbcf40ae3704bab51e
First seen:	2026-04-01 16:50:41 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	24576:iUZrfNa05vOXrSMR/mF5GZx0fJLng0t3HkFd0tWetEr7/m:iUhfs05eAwafJLg0t3EFd0tWeU7u
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 0 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-04-01 16:50:41 UTC Static: 3 Unpacker: 0 ClamAV: 0