YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash eb0b7e7197ef8a33fcbbaacf4267b9fd13404b6d4abe6312e599b6a0ae3de911.

Scan Results

SHA256 hash: eb0b7e7197ef8a33fcbbaacf4267b9fd13404b6d4abe6312e599b6a0ae3de911
File size:184'636 bytes
File download: Original
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
MD5 hash: 1252a88dcf60e4003103cc07b0997058
SHA1 hash: 3ee615dcf1d590faa3a53d3890e6ad2959cd395e
SHA3-384 hash: cbc42256a71a922054e286c043ac7282e6719cdece63be7449d10d06170adffa0f8a9473d0866c6ebe5c3c822dd4e1c6
First seen:2026-08-11 16:23:52 UTC
Last seen:Never
Sightings:1
imphash :n/a
ssdeep : 3072:KX1U6zhwlHakoZA5IM8/nPV8TlxTY9Vxu/tdJUK4NPtaXJR9jRc23QbnOPwuPGB5:KWQZA5I9nPV8TlxTY7xu/tdJUKMPqxy5
TLSH :n/a
telfhash :n/a
gimphash :n/a
dhash icon :n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:0aed7763-95a1-11f1-bf07-42010aa4000b
File name:1252a88dcf60e4003103cc07b0997058
Task parameters:ClamAV scan:True
Unpack:False
Share file:True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:ach_TrickBot_xlsm_20210324
Create hunting rule
Author:abuse.ch
Description:Detects TrickBot xlsm
TLP:TLP:WHITE
Repository:Sandnet
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:TLP:WHITE
Repository:YARAify
Rule name:informational_win_ole_protected
Create hunting rule
Author:Jeff White (karttoon@gmail.com) @noottrak
Description:Identify OLE Project protection within documents.
TLP:TLP:WHITE
Repository:karttoon
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time
TLP:TLP:WHITE
Repository:CD-R0M

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

The following files could be unpacked from this sample.