MALICIOUS — CLM-1780971899-Nov-12.zip

MALICIOUS — CLM-1780971899-Nov-12.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Docusign112101 family. 4 of 55 detection engines flagged it.

Identification

• SHA-256: 3c1c4ff2a171b821533e4c322b5bcc42796ac28470720ac98615997c0092f897
• SHA-1: aaadcfa9d802cb4fe596b24537dee3169a9aa5ba
• MD5: 9f46fcdfb73a4c4939a7a68909f42942
• ssdeep: 1536:8Shv3ZZlHPTkJBUwaHt3y7WOUhnK2rYvSvYwDj6OEyf9lLPekPbpiexPeO:8IZXLiBUfHt3H/hKGZXj7TVPekPbpeO
• TLSH: T12139022465AFE3B346E84E00A2BAEC9C68EF1463F1DC2174898456F051189F3E4797B5
• Submitted as: CLM-1780971899-Nov-12.zip
• File type: zip · Size: 88751 bytes
• Verdict: malicious (97/100) · Family: Docusign112101

Detections (4 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
• Microsoft Defender: TrojanDownloader:O97M/Qakbot
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:O97M/Qakbot (rule TrojanDownloader:O97M/Qakbot) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report