MALICIOUS — 014d0da296b5580eea0d6213578dd91eab9d81a2655c98be23e0c7f5cdba5b3f.zip

MALICIOUS — 014d0da296b5580eea0d6213578dd91eab9d81a2655c98be23e0c7f5cdba5b3f.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 5 of 54 detection engines flagged it.

Identification

• SHA-256: 014d0da296b5580eea0d6213578dd91eab9d81a2655c98be23e0c7f5cdba5b3f
• SHA-1: ec480a7966740a6fe7811e14ed300957e7c5885f
• MD5: 66b1e21e18b41cd7a909681c9137ac84
• ssdeep: 24:9hoLJJKzk0p41AqbMI4V+SulMtp/eNeGieVO7aRfZ+6qGFPxMHVD3k7lASBLoLJ/:9hEJKzkFhbG2+p/rGU+cG3M1BSBLEqw
• TLSH: T14713A8590DA49412FFC390B68B67D2EF1817D8CCE4A3D8D7114B68E0735615B00099CB
• Submitted as: 014d0da296b5580eea0d6213578dd91eab9d81a2655c98be23e0c7f5cdba5b3f.zip
• File type: zip · Size: 1300 bytes
• Verdict: malicious (89/100)

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (5 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL
• Microsoft Defender: Trojan:Script/Sabsik.EN.A!ml
• Emsisoft (Emergency Kit): Trojan.GenericKD.81020223
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Script.Generic

Why this verdict

The malicious score of 89/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL (rule Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: nfe_doc-BF5H55.hta - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• nfe_doc-BF5H55.hta - 9e21cb542d1924e4499c1a34231fd54250d804e46c2b1084e9f50f804f4d434d

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report