YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash caeb9395fbf1cf960153e8ec65167648c738c4bf0946b8b0232187a7daa1eef9.

SHA256 hash:	caeb9395fbf1cf960153e8ec65167648c738c4bf0946b8b0232187a7daa1eef9
File size:	173'141 bytes
File download:	Original
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash:	4e336fc7996e1ccfb6cbc5b50a223a95
SHA1 hash:	039799630a4cbee66dcd6b82017cc091a7323bda
SHA3-384 hash:	3ecd12a049ab5922a960819fe6400f030f7ac8c5042cac5269cfa94d3795befaede37b22b6805b7da68281cd27350979
First seen:	2026-04-09 17:32:42 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	3072:xQYp06DAnJy7h8ra9YFtEtu+cvMhkZrLdR6LElT6LxarAxxdKsuc:xnBkJfrDN7vxf3mEOar2Krc
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

Signature:	YARA.ARKBIRD_SOLG_TA505_Maldoc_21Nov_2.UNOFFICIAL Create hunting rule

The following YARA rules matched on the file (static analysis).

Rule name:	ach_TrickBot_xlsm_20210324 Create hunting rule
Author:	abuse.ch
Description:	Detects TrickBot xlsm
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	TA505_Maldoc_21Nov_2 Create hunting rule
Author:	Arkbird_SOLG
Description:	invitation (1).xls
Reference:	https://twitter.com/58_158_177_102/status/1197432303057637377
TLP:	TLP:WHITE
Repository:	StrangerealIntel

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-04-09 17:32:42 UTC Static: 6 Unpacker: 0 ClamAV: 1