MALICIOUS — 0917fe8414cb1101043cea86163eefa89055e6726f0b22da39fb622c1fb1ad78.zip

MALICIOUS — 0917fe8414cb1101043cea86163eefa89055e6726f0b22da39fb622c1fb1ad78.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 5 of 54 detection engines flagged it.

Identification

• SHA-256: 0917fe8414cb1101043cea86163eefa89055e6726f0b22da39fb622c1fb1ad78
• SHA-1: 7a9052e7d2dc9fd1a927cb015f6447a0a1df26e3
• MD5: 579637c912df4c7db327ff38a51f8f9f
• ssdeep: 24:993r5gRJkF+fcwIJCLhKDidCQnzW9n97r5969THm4/p3dxvgNAnsOrnff345DX:9TUqIIJCgWUQnynZyTH/FdiwswCDX
• TLSH: T14113FBE0D204C566EBD5AA6307377B4D2E0F0B0950A73669CE9DD087CF41BA74573001
• Submitted as: 0917fe8414cb1101043cea86163eefa89055e6726f0b22da39fb622c1fb1ad78.zip
• File type: zip · Size: 1295 bytes
• Verdict: malicious (89/100)

Source: MalwareBazaar · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (5 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL
• Microsoft Defender: Trojan:Script/Sabsik.EN.A!ml
• Emsisoft (Emergency Kit): Trojan.GenericKD.81017071
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Script.Generic

Why this verdict

The malicious score of 89/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL (rule Sanesecurity.Foxhole.Hta_Zip_2.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: file-I2SKBS.hta - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• file-I2SKBS.hta - 9f409b9d2a91fbc8d1f1b152c516d280f03afc8660546059b12b620990fd2a56

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report