MALICIOUS — b264436b0bb0ca5ff0d512a3f681aea0eecd166488a0dceebfb84725cafc1029
MALICIOUS — b264436b0bb0ca5ff0d512a3f681aea0eecd166488a0dceebfb84725cafc1029 is a office-ooxml sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Docusign112101 family. 5 of 51 detection engines flagged it.
Identification
- SHA-256:
b264436b0bb0ca5ff0d512a3f681aea0eecd166488a0dceebfb84725cafc1029 - SHA-1:
8c7d30d764df2433bea34394cd3859580e66efd7 - MD5:
c8216b93c9ab92a337ddc4bc2f2b493d - ssdeep:
1536:AjXB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUOT+5gJ:AOc6EehCfCZpUHKGXbBKsiiD - TLSH:
T1873BF0280BEF6E02EB71683D7AC65D4C0ECCA690E46C1992D62C4088F6D35AFD17512F - Submitted as: b264436b0bb0ca5ff0d512a3f681aea0eecd166488a0dceebfb84725cafc1029
- File type: office-ooxml · Size: 103725 bytes
- Verdict: malicious (95/100) · Family: Docusign112101
Detections (5 of 51 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
- oletools (Office/OLE maldoc): oletools:suspicious-macro
- Microsoft Defender: TrojanDownloader:O97M/Qakbot
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 95/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule
Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95 - Document contains macros/active content: xlm-macro - static signal, weight 0.35, confidence 0.75
- Obfuscated javascript script: defense-evasion (rule
script-deobfuscation) - static signal, weight 0.35, confidence 0.75 - oletools (Office/OLE maldoc) flagged oletools:suspicious-macro (rule
oletools:suspicious-macro) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report