MALICIOUS — e3aaf3257fa484d4cadcde9a8314af2ba34de391b638815260d1402bd9308086
MALICIOUS — e3aaf3257fa484d4cadcde9a8314af2ba34de391b638815260d1402bd9308086 is a office-ooxml sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Docusign112101 family. 5 of 54 detection engines flagged it.
Identification
- SHA-256:
e3aaf3257fa484d4cadcde9a8314af2ba34de391b638815260d1402bd9308086 - SHA-1:
5d67e6974a5f3196fab4673ad834314d9c2aea3b - MD5:
3713cd6bcddad75a05cb5bf11bf7f828 - ssdeep:
1536:AjXB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUOT+5gJ:AOc6EehCfCZpUHKGXbBKsiiD - TLSH:
T11C3BF0280BEF6E02EB71683D76C65D4C0ECCA690E46C1992D62C4088F6D35AFD17512F - Submitted as: e3aaf3257fa484d4cadcde9a8314af2ba34de391b638815260d1402bd9308086
- File type: office-ooxml · Size: 103725 bytes
- Verdict: malicious (95/100) · Family: Docusign112101
Detections (5 of 54 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Xls.Downloader.Docusign112101-9908076-0
- oletools (Office/OLE maldoc): oletools:suspicious-macro
- Microsoft Defender: TrojanDownloader:O97M/Qakbot
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 95/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Xls.Downloader.Docusign112101-9908076-0 (rule
Xls.Downloader.Docusign112101-9908076-0) - engine signal, weight 0.90, confidence 0.95 - Document contains macros/active content: xlm-macro - static signal, weight 0.35, confidence 0.75
- Obfuscated javascript script: defense-evasion (rule
script-deobfuscation) - static signal, weight 0.35, confidence 0.75 - oletools (Office/OLE maldoc) flagged oletools:suspicious-macro (rule
oletools:suspicious-macro) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
More Docusign112101 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report