MALICIOUS — CLM-1836839811-Nov-12.zip

MALICIOUS — CLM-1836839811-Nov-12.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Docusign112101 family. 4 of 55 detection engines flagged it.

Identification

• SHA-256: 48057e83a4d7f84e5de4e572b199ccd4d61a0e1a1c45a190e6a06d381c0757fc
• SHA-1: ef22145d49f1e7da2be27e50385c6311e14e7ec2
• MD5: 9ca4e5f2c7b0aedc030c09b4995605e6
• ssdeep: 1536:DShv3ZZlHPTkJBUwaHt3y7WOUhnK2rYvSvYwDj6OEyf9lLPekPbpiexPeO:DIZXLiBUfHt3H/hKGZXj7TVPekPbpeO
• TLSH: T1AE39021465BFE3B346E84E40A2BAEC9C68EF1463F1EC21B4898496F051189F3E479771
• Submitted as: CLM-1836839811-Nov-12.zip
• File type: zip · Size: 88751 bytes
• Verdict: malicious (97/100) · Family: Docusign112101

Detections (4 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
• Microsoft Defender: TrojanDownloader:O97M/Qakbot
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:O97M/Qakbot (rule TrojanDownloader:O97M/Qakbot) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report