MALICIOUS — Srv-Interrupt-828922134-Nov-10.zip

MALICIOUS — Srv-Interrupt-828922134-Nov-10.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Docusign112101 family. 4 of 55 detection engines flagged it.

Identification

• SHA-256: b1ab7cd95751fe006f9380938d0b30c10239f5ecc0d738d6fd8f55ec2db9c417
• SHA-1: 33e032bdd1a125dff62a37d9d0d802efdf8ef751
• MD5: 4af711248b48003deec448e9006a8b4d
• ssdeep: 1536:QztdbvpC4f+eac1XV+ghhFHlgpQugF4tz/IiyCRCPvF0DJ88KbVu1yV:QJj/ac1kEFFr5FWpydvSG8KwO
• TLSH: T1B83902FB1B739338A6DE86D666C8AD9CC4E2A216F1409012D332F5E54007AFE0658C4E
• Submitted as: Srv-Interrupt-828922134-Nov-10.zip
• File type: zip · Size: 87727 bytes
• Verdict: malicious (97/100) · Family: Docusign112101

Detections (4 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
• Microsoft Defender: TrojanDownloader:O97M/Qakbot
• Kaspersky (KVRT): HEUR:Trojan-Downloader.MSOffice.SLoad.gen

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:O97M/Qakbot (rule TrojanDownloader:O97M/Qakbot) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.MSOffice.SLoad.gen (rule HEUR:Trojan-Downloader.MSOffice.SLoad.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report