YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash e3c5efb0ddeae7f40a57d989aef72810772c337dbcc051cf656eb2afbd93377e.

SHA256 hash:	e3c5efb0ddeae7f40a57d989aef72810772c337dbcc051cf656eb2afbd93377e
File size:	867'941 bytes
File download:	Original
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash:	2ab98fa7a970452c0ccef7202822af36
SHA1 hash:	f066448400c154f8a08c135305de4addccc37805
SHA3-384 hash:	6f2a2bbd31e4b502fc5460b51f8deb641530e60303aaf1ada48d059130013f15a3eb877521fb5977688dcd0ab272b471
First seen:	2026-09-09 02:24:18 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	12288:WcgrzjZ2ERPR6JOQIpSp0v69PfrJdMkII5seebf:krfZ2EjNQD0vOfrJgI23b
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

There are 0 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

The file matched the following open source and commercial ClamAV rules.

No matches

The following YARA rules matched on the file (static analysis).

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	informational_win_ole_protected Create hunting rule
Author:	Jeff White (karttoon@gmail.com) @noottrak
Description:	Identify OLE Project protection within documents.
TLP:	TLP:WHITE
Repository:	karttoon

Rule name:	vbaproject_bin Create hunting rule
Author:	CD_R0M_
Description:	{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:	TLP:WHITE
Repository:	CD-R0M

The following YARA rules matched on the unpacked file.

Disabled by submitter

The following files could be unpacked from this sample.

Disabled by submitter

2026-09-09 02:24:18 UTC Static: 3 Unpacker: 0 ClamAV: 0