MALICIOUS — CLM-858944315-Nov-12.zip

MALICIOUS — CLM-858944315-Nov-12.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Docusign112101 family. 4 of 55 detection engines flagged it.

Identification

• SHA-256: 7a2299e95f3e62cb0919c447f96ff3ee403c390b6141be829f255c86b858a713
• SHA-1: 300145a1c7ef2fe74a1738ce94b1007bf500c07f
• MD5: 7eb55f1b5c766516dcf0086aa2e8932b
• ssdeep: 1536:Ve7mqFIhDvG+5A506FMN6BzFKowrINhb9vTTkaqW4wXWYd/SC:Vei7bG+5ARmN6JFKowrgb9vaw3SC
• TLSH: T10839020017141859FF58D8C1739836EC795B97BC058FA32F9461B453EA18FA053EB167
• Submitted as: CLM-858944315-Nov-12.zip
• File type: zip · Size: 88747 bytes
• Verdict: malicious (97/100) · Family: Docusign112101

Detections (4 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
• Microsoft Defender: TrojanDownloader:O97M/Qakbot
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:O97M/Qakbot (rule TrojanDownloader:O97M/Qakbot) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report