MALICIOUS — Lista de comenzi este atasata.zip

MALICIOUS — Lista de comenzi este atasata.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Wordexe family. 5 of 55 detection engines flagged it.

Identification

• SHA-256: 6414280fb284d3b8eeef18d149c402da25481177e14e96beafb0148142e1f1a4
• SHA-1: 7ccb579a3c4aaf63d967e0b4cd8e10b2c1953585
• MD5: bd113c82072b70779c5e97e0c0e121a2
• ssdeep: 6144:ae9goXUZBMcuTzpsmAKb039VdK3az7wYiwNLsJIsDYJhYwJlWG1zunoHphzJK8d5:az9BL8zpsmEdSdXJIOQJ116OnKuui
• TLSH: T1F14B2317C7AF5B6FBD5D32D9AE4CCB5AAC0826C2032DF2310F9BA93588744D940165A3
• Submitted as: Lista de comenzi este atasata.zip
• File type: zip · Size: 480776 bytes
• Verdict: malicious (99/100) · Family: Wordexe

Detections (5 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Zip_Wordexe.1.UNOFFICIAL
• Microsoft Defender: Trojan:Win32/DelfInject.AM!MTB
• Emsisoft (Emergency Kit): Trojan.GenericKD.47405305
• Kaspersky (KVRT): HEUR:Backdoor.Win32.Remcos.gen

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Zip_Wordexe.1.UNOFFICIAL (rule Sanesecurity.Foxhole.Zip_Wordexe.1.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/DelfInject.AM!MTB (rule Trojan:Win32/DelfInject.AM!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.47405305 (rule Trojan.GenericKD.47405305) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Remcos.gen (rule HEUR:Backdoor.Win32.Remcos.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: Lista de comenzi este atasata.exe - static signal, weight 0.25, confidence 0.50

Archive contents (1 executable)

This zip carries 1 extracted member, each analyzed as its own sample:

• Lista de comenzi este atasata.exe - c902cb038d194ee56e728c30a1e1b8121cd76781ebc4e71b5627f094fdd0e707

More Wordexe samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report