YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 80f1ef7c1fcd4d4fdd262c3d55030016f0cf97cf30c97580c7d92088f4107d5e.

Scan Results

SHA256 hash: 80f1ef7c1fcd4d4fdd262c3d55030016f0cf97cf30c97580c7d92088f4107d5e
File size:1'280'936 bytes
File download: Original
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash: 17955abc649bf3ef1a0b6daa0d41b28c
SHA1 hash: c3c5a075e002b139eeed16bef4f9c7f264b38783
SHA3-384 hash: 6d3c9a726dc55a19cb9292e7eb44fd387b2c4ae46b7146b02e3380cf3e5a84b196f765823b4858b156eee659c8d1297c
First seen:2025-11-21 02:53:43 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 24576:TpE3eoYExpMq0OcN7JmKlgIozoRpwgU80VDU+NEpt8WfNdH/s7TiFr:t0eo3PMq8dUcgdzoRpwgURDUlF2W5
TLSH : T1E155121C51FFE37AEA52C7751A9560D746E52C40FEE38A0DF400925FE413B83CA2AB26
Create hunting rule
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:4ab3e39c-c685-11f0-adeb-42010aa4000b
File name:17955abc649bf3ef1a0b6daa0d41b28c
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
TLP:TLP:WHITE
Repository:karttoon
Rule name:office_document_vba
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Office document with embedded VBA
Reference:https://github.com/jipegit/
TLP:TLP:WHITE
Repository:
Rule name:TA505_Maldoc_21Nov_2
Create hunting rule
Author:Arkbird_SOLG
Description:invitation (1).xls
Reference:https://twitter.com/58_158_177_102/status/1197432303057637377
TLP:TLP:WHITE
Repository:StrangerealIntel
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:TLP:WHITE
Repository:CD-R0M

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.