YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 7821a53e914a588c7f9f70b56cfaf1fc6aef262ba75169a094193fc219a63da9.

SHA256 hash:	7821a53e914a588c7f9f70b56cfaf1fc6aef262ba75169a094193fc219a63da9
File size:	106'870 bytes
File download:	Original
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash:	9980aac3f66ec16394ec282120d0904e
SHA1 hash:	12f7abaeed1c781303b34ab882d0e33df6a49752
SHA3-384 hash:	8152dbe0c20e721215b767e989173a6f80682183d05b045c114b530f8a0d6082c72fb087c8bc1ba6cc5ed916aea51c6c
First seen:	2026-02-11 17:18:02 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	3072:Ww97JxYoY63G+dr8T+wrKmjN4JU+KBXobT2AAb4X+:WA8a3jaSTU+KB4biCX+
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	ach_Quakbot_xlsb_20201023 Create hunting rule
Author:	abuse.ch
Description:	Detects Quakbot XLS
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	BazarLoader Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule to Detect Bazar Loader
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-02-11 17:18:02 UTC Static: 4 Unpacker: 0 ClamAV: 0