MALICIOUS — CLM-517701879-Nov-12.zip

MALICIOUS — CLM-517701879-Nov-12.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Docusign112101 family. 4 of 51 detection engines flagged it.

Identification

• SHA-256: 18f3068cd33e3c8f1d6aebf99bb5602bdeaf12d5c35cd49ba68e642b0954316d
• SHA-1: 4ce151ab0b73622b2c2b00020525378aae2281fa
• MD5: f8f54fbedb9b22ad48f8522d0b1ba8cc
• ssdeep: 1536:8damqSRJBW0fPAjOiNfE3xO0hK2kpzwHlLg/YB5V8Y2dp/Wz7hLrqCHBkc:8dD3vPcj0xhKz1wHlLgUgYWehLOWBZ
• TLSH: T18239136D74F98A72D84F4E19D2EE5824BD9438D665E2FA2D112B60CB4350F91D3E700C
• Submitted as: CLM-517701879-Nov-12.zip
• File type: zip · Size: 88747 bytes
• Verdict: malicious (87/100) · Family: Docusign112101

Detections (4 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
• Microsoft Defender: TrojanDownloader:O97M/Qakbot
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 87/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report