MALICIOUS — 0bf9c8427a60d343df0edd640f2e6e6ac40b02a937f99156e60baa75e87a7421.zip

MALICIOUS — 0bf9c8427a60d343df0edd640f2e6e6ac40b02a937f99156e60baa75e87a7421.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 4 of 54 detection engines flagged it.

Identification

• SHA-256: 0bf9c8427a60d343df0edd640f2e6e6ac40b02a937f99156e60baa75e87a7421
• SHA-1: c41959a28cb6a96937d2ba62ca89c4666152229b
• MD5: 76d50b197ae5d74345b45bce41c64f4b
• ssdeep: 24:9K3eMxMErGEJGE8hYiavaEK4z1KliIomBeCkg:9nOtYthrav3Bz1WMCkg
• TLSH: T12E12729F06209790CF62E6492AC44E8CB9B3886DFA321F9B135884240E2409F082D08F
• Submitted as: 0bf9c8427a60d343df0edd640f2e6e6ac40b02a937f99156e60baa75e87a7421.zip
• File type: zip · Size: 1068 bytes
• Verdict: malicious (87/100)

Detections (4 of 54 engines)

• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Zip_jpg.UNOFFICIAL
• Microsoft Defender: Trojan:Win32/WinLNK!MSR
• Trellix Stinger (McAfee): Suspect-CY!76D50B197AE5
• Kaspersky (KVRT): HEUR:Trojan.Multi.Agent.gen

Why this verdict

The malicious score of 87/100 is the fusion of 2 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Zip_jpg.UNOFFICIAL (rule Sanesecurity.Foxhole.Zip_jpg.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Archive contains executables: PIC0402023/PIC0402023.jpg.lnk - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• PIC0402023.jpg.lnk - b8dd2c924604e8d4cac9a235cee2bf49a375727438f705a0028d0c89b7f9f1b7

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report