MALICIOUS — 0624ed60d6b3fef69e93245fbd450ce16dd3fda04c02e4165223e2be38ce1ca5.zip

MALICIOUS — 0624ed60d6b3fef69e93245fbd450ce16dd3fda04c02e4165223e2be38ce1ca5.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 4 of 54 detection engines flagged it.

Identification

• SHA-256: 0624ed60d6b3fef69e93245fbd450ce16dd3fda04c02e4165223e2be38ce1ca5
• SHA-1: 6d41d184c1e632b73cbade16e7b1ef2603e557f0
• MD5: 5131293a86addc3f8d82e9d1f1e20021
• ssdeep: 12:5jiL/H+G93gLEm82CbWXwZYp8eLwpGwLSKHTrwLiC6ACd3AZmjj/7OwI2sdaoS:9Y/oLEmUbWcnTx7HTrJJqwpmS
• TLSH: T105116381D65D31CCEA7000182684B78D7B5E0490490466404F50D7166B5CD8B7370694
• Submitted as: 0624ed60d6b3fef69e93245fbd450ce16dd3fda04c02e4165223e2be38ce1ca5.zip
• File type: zip · Size: 864 bytes
• Verdict: malicious (89/100)

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (4 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
• Microsoft Defender: flagged
• Kaspersky (KVRT): HEUR:Trojan.WinLNK.Rufus.gen

Why this verdict

The malicious score of 89/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL (rule Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: DOC-1P91M2.lnk - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• DOC-1P91M2.lnk - 6e012f1d229f2288126b88ed09cf20ebf74fde78ee0b576ca6407b2260d3a2e1

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report