YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash dbd8b56f846fe554e2884234d9689c0859b22adb745275fcdba74403cedea696.

SHA256 hash:	dbd8b56f846fe554e2884234d9689c0859b22adb745275fcdba74403cedea696
File size:	211'143 bytes
File download:	Original
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash:	3530750692e2c41ff354028e415e1eb0
SHA1 hash:	af8856a603830b04647630fdff1e194c4ff3c0df
SHA3-384 hash:	34a44edddb5ece55548b2e67017e9ffb44c2655280785257615f46c1384044a52ee131244ec5cf422d33b17f8a7175d1
First seen:	2026-09-09 02:27:58 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	6144:BdYGO1cLHth3otA18P4u2Cjrx2Zp56PTB6yuO23BUXIr2g:XO1IGvcpArB6XO4SI7
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 0 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-09-09 02:27:58 UTC Static: 3 Unpacker: 0 ClamAV: 0