MALICIOUS — ca80cd89c710e442d447b4905f38a51b5985e072bcbd31cff0e2ad9a451b32c0

MALICIOUS — ca80cd89c710e442d447b4905f38a51b5985e072bcbd31cff0e2ad9a451b32c0 is a office-ooxml sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Docusign112101 family. 5 of 51 detection engines flagged it.

Identification

• SHA-256: ca80cd89c710e442d447b4905f38a51b5985e072bcbd31cff0e2ad9a451b32c0
• SHA-1: 52959654aad2b0db50ca4628ff62128febc81521
• MD5: 50ea29dadf34166d2d82795e6249665b
• ssdeep: 1536:zXB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUu0o8d6u:ec6EehCfCZpUHKGXbBKsiiQoG
• TLSH: T1903BF0280BEF2D46EB61987D36C59D4C1EDCA250F45C0992C62C4198F6E35AFD07612F
• Submitted as: ca80cd89c710e442d447b4905f38a51b5985e072bcbd31cff0e2ad9a451b32c0
• File type: office-ooxml · Size: 102502 bytes
• Verdict: malicious (95/100) · Family: Docusign112101

Detections (5 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
• oletools (Office/OLE maldoc): oletools:suspicious-macro
• Microsoft Defender: TrojanDownloader:O97M/Qakbot
• Kaspersky (KVRT): HEUR:Trojan-Downloader.MSOffice.SLoad.gen

Why this verdict

The malicious score of 95/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95
• Document contains macros/active content: xlm-macro - static signal, weight 0.35, confidence 0.75
• Obfuscated javascript script: defense-evasion (rule script-deobfuscation) - static signal, weight 0.35, confidence 0.75
• oletools (Office/OLE maldoc) flagged oletools:suspicious-macro (rule oletools:suspicious-macro) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report