SUSPICIOUS — 7189a13d9281c2d6ef0ca7be48818a90e5269e6bbf072c7a118ba1c52f5754f8

SUSPICIOUS — 7189a13d9281c2d6ef0ca7be48818a90e5269e6bbf072c7a118ba1c52f5754f8 is a office-ooxml sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (36/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: 7189a13d9281c2d6ef0ca7be48818a90e5269e6bbf072c7a118ba1c52f5754f8
• SHA-1: 6c7e41df223f65f881afacbcca57fc5936f02444
• MD5: dfb8d15f6262a3825123d7e7f17d0e4e
• ssdeep: 384:97h9lXxM679CSzq4emkUExvOhIST2PnCB71FYODgEjH:LDXy63emkbVOyF/CFZ1H
• TLSH: T1632BAED5C6BD0C19F3C9EA16D135398D9CC818744E398BD196AB80C76D85307AE380AF
• Submitted as: 7189a13d9281c2d6ef0ca7be48818a90e5269e6bbf072c7a118ba1c52f5754f8
• File type: office-ooxml · Size: 23062 bytes
• Verdict: suspicious (36/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Kaspersky (KVRT): HEUR:Trojan.MSOffice.Generic

Why this verdict

The suspicious score of 36/100 is the fusion of 2 weighted signals:

• Document contains macros/active content: xlm-macro - static signal, weight 0.35, confidence 0.75
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report