MALICIOUS — 2953ee556474482c1b4e426de140dc7f6b931da94cf9309ab584993483051990
MALICIOUS — 2953ee556474482c1b4e426de140dc7f6b931da94cf9309ab584993483051990 is a office-ooxml sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Docusign112101 family. 5 of 51 detection engines flagged it.
Identification
- SHA-256:
2953ee556474482c1b4e426de140dc7f6b931da94cf9309ab584993483051990 - SHA-1:
8f710d697beabaac7b96f4085c5b20f5b8cd8336 - MD5:
09bd4177f016c01ecf595c37f93fbb3d - ssdeep:
1536:Q+XB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsU6uq+0SS:Cc6EehCfCZpUHKGXbBKsiiV/ - TLSH:
T12A3BE0280BEF6E46EB61997E76C64D0C0EDCA250B49D1983862C4188F6D35BFC07522F - Submitted as: 2953ee556474482c1b4e426de140dc7f6b931da94cf9309ab584993483051990
- File type: office-ooxml · Size: 103736 bytes
- Verdict: malicious (95/100) · Family: Docusign112101
Detections (5 of 51 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
- oletools (Office/OLE maldoc): oletools:suspicious-macro
- Microsoft Defender: TrojanDownloader:O97M/Qakbot
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 95/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule
Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95 - Document contains macros/active content: xlm-macro - static signal, weight 0.35, confidence 0.75
- Obfuscated javascript script: defense-evasion (rule
script-deobfuscation) - static signal, weight 0.35, confidence 0.75 - oletools (Office/OLE maldoc) flagged oletools:suspicious-macro (rule
oletools:suspicious-macro) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report