MALICIOUS — 9a3c1728757c81c382fe0672afdd37898e2fd3236f3e7cde71e37902d0715399

MALICIOUS — 9a3c1728757c81c382fe0672afdd37898e2fd3236f3e7cde71e37902d0715399 is a email sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Wordexe family. 1 of 54 detection engines flagged it.

Identification

• SHA-256: 9a3c1728757c81c382fe0672afdd37898e2fd3236f3e7cde71e37902d0715399
• SHA-1: a2fef4ede2df42874a787195364476fb8d88330b
• MD5: 198143e2ca8f417e3bb6d28c0b88d1f7
• ssdeep: 12288:GYQUapMXomaGlS7246x83PpRh9lRbN04KtM+SUXRSdeX9PwRMfwe1:G5YYDGlS7D5pX9KflEwFn
• TLSH: T1784E2386F898E656BFC1AAC20052DBB2361A5F625D10C9CFBA9115E89FDDDF0D11CC80
• Submitted as: 9a3c1728757c81c382fe0672afdd37898e2fd3236f3e7cde71e37902d0715399
• File type: email · Size: 653632 bytes
• Verdict: malicious (91/100) · Family: Wordexe

Detections (1 of 54 engines)

• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Foxhole.Zip_Wordexe.1.UNOFFICIAL

Why this verdict

The malicious score of 91/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Foxhole.Zip_Wordexe.1.UNOFFICIAL (rule Sanesecurity.Foxhole.Zip_Wordexe.1.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: 94.130.135.43, 5.62.58.11 - static signal, weight 0.35, confidence 0.60
• Suspicious email carrier: archive-attachment - static signal, weight 0.30, confidence 0.70

Embedded URLs

• http://www.w3.org/TR/REC-html40/loose.dtd

Embedded domains

• r-11-58-62-5.consumer-pool.prcdn.net
• www.w3.org

Embedded IP addresses

• 94.130.135.43
• 5.62.58.11

More Wordexe samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report