MALICIOUS — 079f7c942ee89d35aea5f9833280ed258124911ce9bb84ed6a4dd92b5eef6b0b.zip

MALICIOUS — 079f7c942ee89d35aea5f9833280ed258124911ce9bb84ed6a4dd92b5eef6b0b.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 4 of 54 detection engines flagged it.

Identification

• SHA-256: 079f7c942ee89d35aea5f9833280ed258124911ce9bb84ed6a4dd92b5eef6b0b
• SHA-1: 9ec00c6b09419dcfbc6f333071dc540c5e5270a3
• MD5: 27e7d5d508d6b5eb3975aef10ee293bb
• ssdeep: 24:9Xho0rCTatF1HW5zitJpaFkS1Drn946hmlVk7WJRy3XNJ4Jn7JBrn1CY6Kz:9jrCIsPkS1DzOk7VHwV/r1CtI
• TLSH: T14A12D7C48FAA3B13D9E007E32DA06BDBF4C982470706734C1206E027942C4D38280EF4
• Submitted as: 079f7c942ee89d35aea5f9833280ed258124911ce9bb84ed6a4dd92b5eef6b0b.zip
• File type: zip · Size: 1186 bytes
• Verdict: malicious (89/100)

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (4 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL
• Microsoft Defender: Trojan:Script/Sabsik.EN.A!ml
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Script.Generic

Why this verdict

The malicious score of 89/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL (rule Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: NotaFiscal_-KG6RLT.hta - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• NotaFiscal_-KG6RLT.hta - fa31f8fcf9f7c973bba585050f7fa2bb9944d5df1ed20bd2ea12713f77cc470b

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report