YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash 7cc2788e64d7df37858279a1922a7b78a9c14b960f102adf19aa505179d4d30d.
Scan Results
| SHA256 hash: | 7cc2788e64d7df37858279a1922a7b78a9c14b960f102adf19aa505179d4d30d | |
|---|---|---|
| File size: | 1'339'758 bytes | |
| File download: | Original | |
| MIME type: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet | |
| MD5 hash: | 757fd8da64807ed1ea086ba41259f3d5 | |
| SHA1 hash: | 3fd0edc61b556ce386cf9a083ec70242dbe1cc1c | |
| SHA3-384 hash: | d1151e591915dbd918a7fae33ff907b9762d7ed2fcb4cd2a938668ef4fec90a5bf27bff172aa364c23a1e5240e1e9683 | |
| First seen: | 2025-10-14 22:25:39 UTC | |
| Last seen: | Never | |
| Sightings: | 1 | |
| imphash : | n/a | |
| ssdeep : | 24576:1X9F8aUDq4gJiZm9PnoYE1bvZ0fSKMZi7ArqB0Bd6t374:1XgaUD5gcMVoYE1V0fSKMZiCqB0HP | |
| TLSH : | T121552375C848BD0FC9C690BD22BA2CD8C6963AA8C584C917B570A5AF2CC3DCB1778D5D | |
| telfhash : | n/a | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | b670f861-a94c-11f0-adeb-42010aa4000b | |
|---|---|---|
| File name: | 757fd8da64807ed1ea086ba41259f3d5 | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
No matches
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | informational_win_ole_protected |
|---|---|
| Author: | Jeff White (karttoon@gmail.com) @noottrak |
| Description: | Identify OLE Project protection within documents. |
| TLP: | TLP:WHITE |
| Repository: | karttoon |
| Rule name: | office_document_vba |
|---|---|
| Author: | Jean-Philippe Teissier / @Jipe_ |
| Description: | Office document with embedded VBA |
| Reference: | https://github.com/jipegit/ |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | TA505_Maldoc_21Nov_2 |
|---|---|
| Author: | Arkbird_SOLG |
| Description: | invitation (1).xls |
| Reference: | https://twitter.com/58_158_177_102/status/1197432303057637377 |
| TLP: | TLP:WHITE |
| Repository: | StrangerealIntel |
| Rule name: | vbaproject_bin |
|---|---|
| Author: | CD_R0M_ |
| Description: | {76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time |
| TLP: | TLP:WHITE |
| Repository: | CD-R0M |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter