SUSPICIOUS — 7aa2b8c596a51294a12093d70439dae8bf2ff642c1a0d2bed0b026013dbfcf12

SUSPICIOUS — 7aa2b8c596a51294a12093d70439dae8bf2ff642c1a0d2bed0b026013dbfcf12 is a office-ooxml sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (36/100). 2 of 51 detection engines flagged it.

Identification

• SHA-256: 7aa2b8c596a51294a12093d70439dae8bf2ff642c1a0d2bed0b026013dbfcf12
• SHA-1: a37c96fb3e3afc02066367459410464cbd990642
• MD5: 7787b7e2dad00c0a785bb871a1c177f2
• ssdeep: 384:97l1lLxI679CSzq4emkUExvOhIST2PnCBX1FYGDgEEA:/7Lu63emkbVOyF/6F1iA
• TLSH: T1982BBFD6E2BD0815D3C4EB52D039398CADD884344E25CF91A6AB51C7AA81207E9340EF
• Submitted as: 7aa2b8c596a51294a12093d70439dae8bf2ff642c1a0d2bed0b026013dbfcf12
• File type: office-ooxml · Size: 23062 bytes
• Verdict: suspicious (36/100)

Detections (2 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Kaspersky (KVRT): HEUR:Trojan.MSOffice.Generic

Why this verdict

The suspicious score of 36/100 is the fusion of 2 weighted signals:

• Document contains macros/active content: xlm-macro - static signal, weight 0.35, confidence 0.75
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report