Malicious code classifications and threat types

Products

• Email Security.cloud

Issue/Introduction

These tables list the malicious code names, types, and descriptions as they appear on the reports from the cloud security services support team. These tables also provide information you can use to determine why a particular email has been stopped. Furthermore, the tables provide details about the class of potential threat that is contained in the email.

Cause

https://datatracker.ietf.org/doc/html/rfc2822

Resolution

Virus types

Type	Description
Crack	A program that is designed to modify another program. This modification is usually intended to remove copy protection from a piece of commercially available software. Crack programs usually contain Trojan horses or other unwanted programs. Users can be duped by promises of a free "crack" and are enticed to run some type of code.
Damaged	Malicious code has been removed but some code may still remain.
False positive	Incorrectly identified as malicious.
Joke	Not malicious, but a potentially unwanted program (PUP).
Malicious	Maliciouscode, or software with bad intent.
Speculative	This term is very generic and is used when our heuristics discover a program that is at least a PUP, although likely worse.
Phish	A "phishing" attack, as in "fishing", but instead using online baiting techniques to obtain confidential information from unsuspecting users.

 

Virus names

 

Virus Name	Type	Description
TXT/Generic!info	Crack	Stopped because we detected some information that explains how to operate a software crack.
W32/Crack-	Crack	This virus is a PUP that can be used to modify protected files.
EML/Worm.XX.dam	Damaged	A file that was cleaned by another antivirus scanner but that was stopped by our Email Services. The email is intercepted by our service and includes a disclaimer that is added by the sender's software. The "XX" portion of "EML/Worm.XX.dam" represents an acronym of the third-party software that inserted the disclaimer. The email does not appear to include a virus and has supposedly been scanned by a third-party antivirus scanner, but we cannot guarantee the email is clean.
Exploit/Link.dam	Damaged	Detected because it contains links that are contained within an email that are not in the correct http:// or https:// format such as links that start with anything other than this.
JS/ExploitExec.dam	Damaged	A link within an email that is considered suspicious by our link-following technologies. This is because the link appears to have been damaged in some way and link-following cannot resolve the link correctly.
VBS/Generic.dam	Damaged	Exposed VBA code that is damaged but has some features that would directly affect areas of Windows which is behavior we have seen before within malware.
W32/Bagle.gen!pic.dam	Damaged	A corrupted archive with Bagle-like features. It is probably damaged due to being bounced and truncated.
W32/Generic.dam	Damaged	Damaged malware was detected. Damaged malware is usually a result of partial disinfection or truncation of the original email as it passed through other MTAs.
W32/Kedebe.E-mm-xxxx!eml.dam	Damaged	A damaged copy of the Kedebe virus where the code is no longer executable due to changes within the malicious code.
W32/Mydoom.M.zip.dam	Damaged	A damaged archive file that matches some of the heuristics for Mydoom.M
W32/Netsky.x.dam	Damaged	A damaged copy of the mass-mailing virus Netsky.
W32/Grew.A-mm-xxxx!eml.dam	Damaged	A damaged copy of the Grew.A virus where the code is no longer executable due to changes within the malicious code or items being stripped.
W97M/Generic.dam	Damaged	A malicious Microsoft Office document that contains a macro that no longer functions correctly and as a result is damaged.
Data/Mydoom.log.dam	Damaged	Mydoom.M worm creates encrypted log files and sometimes sends them out instead of its own code due to a bug. As a result the encrypted data files are sent in a compressed archive inside emails. The files have random (encrypted) content, which are about 1.1 or 1.2 kilobytes long. As the log files are not the source code this file is regarded as damaged.
W32/Delf-Generic.dam	Damaged	A damaged Trojan that has been packed with a UPX file compressor.
Image/AppendedHTML.dam	Damaged	This instance occurs when the image file has had HTML appended to it but the code does not work for some reason.
W32/Bobax.AH-mm-22cd!eml.dam	Damaged	This instance is a damaged copy of the Bobax.AH mass mailing virus, and the code no longer executes due to changes within the code of the item has been stripped.
Possibly-infected-with-an-unknown-virus	False positive	We require a sample to further investigate the issue.
Joke.xxxxxxxxxxx	Joke	These are PUPs that are not legitimate business mails. They are joke programs that are not normally malicious
not-virus:BadJoke.Win32.Stript	Joke	The script in this email is usually detected as a joke program.
W32/Joke.Gen-xxxx-xxxx	Joke	These are PUPs that are not legitimate business mail, but are not normally malicious.
bigbrother	Joke	A PUP that makes users think that they can take a photo with their PC. This is not a legitimate business mail and is not normally malicious.
W32/Beast.xxxx	Malicious	A standalone executable that infects Microsoft Word documents by embedding itself in them. It adds an AutoOpen macro to the document to run the embedded virus when the document is opened.
Exploit-WordPad.a.gen	Malicious	This is a generic detection for exploits targeting a WordPad text converter vulnerability.
Exploit-MSWord.a	Malicious	This is a generic detection for exploits targeting a WordPad text converter vulnerability.
Email-Worm.Win32.Agent.ev	Malicious	Spreads as an attachment in spam email with attention grabbing lines in the subject field.
Exploit-ObscuredHtml	Malicious	This is detected as a Trojan. Microsoft Internet Explorer ignores certain non-ASCII characters, allowing an attacker to obfuscate malicious code and still have it rendered by IE. The detection covers HTML documents that have been crafted with the intention of evading antivirus detection.
Generic.f	Malicious	This is detected as a Trojan. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked Web pages, Internet Relay Chat (IRC) and peer-to-peer networks.
JS/ExploitGUID-	Malicious	Globally unique identifier, a unique 128-bit number that is produced by the Windows OS or by some Windows applications to identify a particular component, application, file, database entry, and/or user. These are known GUIDs of files that are known to be exploitable.
LNK.CmdExploit	Malicious	A Windows Shortcut File that, when clicked, downloads malware to the user's PC .
RemAdm-PSKill	Malicious	Detected as a PUP. The program can terminate processes on local or remote WinNT or Win2K systems. This tool was built for use by administrators to perform remote system administration. However, this application is used by many Trojans.
W97M/Class.Q	Malicious	Detected as a Word macro virus that uses an effective way to hide its code. The virus installs its module to Word classes by using special WordBasic operators. The virus code is appended as a native Word component. As a result the virus is not visible in the Tools/Macro menu.
W97M/Concept-b	Malicious	Detected as spyware.
W97M/Wrench.A	Malicious	Detected as a Word 97 macro virus that infects the global template when an infected document is opened or closed. During infection, the virus creates two temporary files, "c:Bench" and "c:BenchFrm". After infection, the virus deletes all "Bench*" files from the root of the C: drive - including the temporary files that are created by the virus.
W32/Fujacks!htm	Malicious	An iframe is appended to the HTML document. It downloads the Fujacks virus and then spreads it by appending itself to every email sent from the senders computer as a hidden iframe. In this way it infects recipients' computers.
UNK/Lastchance	Malicious	This is where viral content has been detected but has yet to be named and requires further review.
W32/Autorun.worm.i.gen	Malicious	Detected as a worm that attempts to spread to removable drives by creating an autorun.inf file. The autorun.inf file will run the worm automatically if systems that use the removable drive are set to allow autorun. The worm also infects Microsoft Word files.
XF/Sic.gen-	Malicious	Detected as a macro virus. Written in Excel4 macro code, the virus can infect both Excel95 and Excel97 format file types.
PWS-LegMir.gen.k	Malicious	PWS-LegMir.gen.k drops PWS-LegMir.gen.k.dll, which steals passwords from multiple games. It will spread using autorun.inf in the root folder of available drives in the system and download updates of itself.
Exploit-MIME.gen.c	Malicious	This generic detection covers email message files that exploit the Microsoft Incorrect MIME Header vulnerability. This vulnerability allows attached executable files to be run when a message is simply viewed.
Exploit/Link-MalDomain-	Malicious	This is a domain that is known to host malware.
Downloader-AYJ	Malicious	This is a Trojan downloader that uses an iframe exploit to route to another server to install further malware.
W97M/Thus.gen	Malicious	This is a virus that infects Word 97 documents. The virus consists of a module called ThisDocument. It will infect the Word normal.dot file. When it infects, it turns the Word 97 Macro Warning feature off. Before infecting a document, the virus will look to see if it has already infected the document by checking for a comment (thus.000). If this comment is found, the virus will not reinfect. On December 13, if an infected document is opened the virus will attempt to delete all files on drive C: (including subdirectories).
Exploit/BBB-	Malicious	These are specific heuristics that are designed to stop known malicious links sent by email from the BBB gang. When the malicious links are clicked on, malicious code is downloaded. Examples of these emails are fake tax court mails, IRS tax scams, and fake court subpoenas. Usually, all of these emails are sent to the addresses of high-profile personnel.
W32/Netsky-x!xxxx	Malicious	This is a variant of the Netsky virus and is malicious. (-x could be any character and !xxxx will be the first 4 characters of the MD5 checksum.
Trojan-Clicker.HTML.IFrame.fh	Malicious	Detected as a malicious iframe that is appended to a HTML document that downloads Trojans to a victim's computer.
W32/Warezov-Heur	Malicious	A variant of the Warezov virus, which is a mass-mailing worm  that spreads through email attachments.
VBA/Generic.src	Malicious	Detected as the source for a VBA macro virus (Word, Excel, PowerPoint, etc.). Some macro viruses store their source code in a temporary file when transferring their code from one file to another. This is detection for the temporary file.
Exploit-ZIP.b	Malicious	This is a zip file that has been crafted to exploit MS02-054 (long file names in zip files).
JS/Exploit-Iframe	Malicious	This is detection for malicious iframes embedded on legitimate websites as well as purposely designed malicious websites.
W97M.VMPCK1.gen	Malicious	This is detection for mis-disinfected malware. Our heuristics are more aggressive for the detection for viruses created using the "VMPCK v1.0" construction kit.
Exploit/LinkAliasPostcard-xxxx	Malicious	This is an aliased link that takes you to a known malicious greeting card site. This is highly suspicious because the link extension is aliased (For example, the link is .php but appears as .jpg in the email. When clicked on, the original link runs). This is usually done to hide the fact that this is a malicious greeting card site link that will infect your PC with malware.
TXT/Qhost.gen	Malicious	This is a generic detection for Trojans that modify the hosts file.
Exploit-URLSpoof.gen	Phishing	This is a Trojan that has been seen in large rounds of spam. This is part of various phishing scams, enticing users to navigate to seemingly authentic websites to steal account and personal information.
Exploit/Phishing-	Phish	These emails are scams that do not contain any viral content. They have a link to a fake Web page that steals users' personal details when they attempt to log on . This can also be triggered by forwarding mails that users have received, as well as the occasional false positive.
Link-Exploit/Phishing-	Phish	These emails are scams that do not contain any viral content. They have a link to a fake Web page that steals users' personal details when they attempt to log on . This can also be triggered by forwarding mails that users have received, as well as the occasional false positive.
Trojan-Spy.HTML.Fraud.gen	Phish	These are phishing scam emails that do not contain any viral content. They have a link to a fake Web page that steals users' personal details when they attempt to log on.
Exploit/PhishLogin	Phish	This is a phishing scam mail that was sent to tempt users to log on to a fake banking site.
Phish-BankFraud.eml.b	Phish	These are phishing messages that are designed to steal bank account information.
Exploit/BouncedGeneric	Speculative	This is a deliberate heuristic that is designed to catch bounce backs that contain suspicious attachments such as zip files.
Exploit/CVE-	Speculative	These can be malicious and are usually Microsoft Office documents that exploit vulnerabilities in Office software. However, we do see that occasionally there are a few Office documents that contain similar properties as the exploit and as a result are incorrectly identified as a false positive.
Exploit/Fraud-AccUpdate	Speculative	These are mails that are similar to phishing mails; however, they ask users to reply with their user name and password and are usually for Webmail accounts
Exploit/HiddenIFrame-xxxx	Speculative	This is a hidden iframe contained within an email. When the iframe is executed, it is invisible to the end user.
Exploit/Link-	Speculative	This detection looks at the link contained within an email and checks that the link is correct, such that the extension is correct and not aliased by a different extension.
Exploit/Link-DogpileRedirect.gen	Speculative	This is a detection for links that are using DogPile redirects to direct users to malicious content.
Exploit/Link-SuspExe-	Speculative	This is where a link within an email is to an .exe file that is suspicious.
Exploit/Link-ZhelHost-	Speculative	This is where a URL contained within an email appears to start with an IP address rather than a domain name. The email that arrives in is usually spam that tries to entice the user to visit a website that hosts malware that is downloaded when the user visits the site.
Exploit/MimeTypeMismatch	Speculative	This is where an item in the mail, such as a .jpg, has been incorrectly tagged in the MIME as another item such as a .com file.
Exploit/MIMEHeaderLength-	Speculative	This is a MIME Header that exceeds the recommended length as per: https://datatracker.ietf.org/doc/html/rfc2822  Common failures that are seen include cases where gateways break the header line into more than one part and insert other headers in between. This can cause unexpected behavior if the MIME structure is destroyed. This can flag for the following fields: Subject, Thread-Index, To, X-MIMETrack & References.
Exploit/MouseOver	Speculative	This is an exploit of the MouseOver function that allows malformed MouseOver code to be used to run arbitrary code. The arbitrary code can be used to obtain personal information or execute specific attacks.
Exploit/OLEHiddenEXE	Speculative	This is an exploit in which an embedded .exe can be hidden in a Word document (OLE file format). The .exe can be used to execute code or even download malicious content to a user's computer.
Exploit/RemoteMHTM-	Speculative	An MHTLM document that is an archived Web page, which can be exploited to drop malicious content on to the recipient's computer.
Exploit/RTFEmbeddedExe	Speculative	This is usually an email with a link to an .exe inside of an .rtf document. The .exe then downloads malicious files to the user's computer.
Exploit/SuspExeInOLE	Speculative	This is usually where a suspicious .exe file has been embedded within a document file. This particular instance is suspicious because the .exe has been embedded within an OLE file.
Exploit/SuspLink-	Speculative	This is usually where a link contained within an email is suspicious.
HeurAuto-	Speculative	This is a detection flagged by traffic heuristics, which has identified a suspicious mail pattern.
JS/Decoder	Speculative	This is a piece of JavaScript that appears to be decoding a section of data, potentially hiding malicious executables or redirects.
JS/ExploitExec	Speculative	A link within an email that has been considered to be suspicious by our link verification (link-following) technologies.
JS/Generic	Speculative	This is usually flagged as suspicious because JavaScript functions have been used to obfuscate certain function calls within an attachment of a mail.
JS/Generic.TxSp	Speculative	This is usually where JavaScript appears to be encoded in such a way that it appears to be spam-like obfuscation.
JS/Selfaltering	Speculative	This is a piece of JavaScript that appears to alter its own content. This is common in scripts designed to obfuscate malicious code or spam.
Link-Exploit/Link-	Speculative	A link within an email that is considered to be suspicious by our link-following technologies.
Link-JS/ExploitExec	Speculative	This is where the link contained in the email appears to be suspicious and has therefore been detected by our link-following technologies.
Link-VBS/Generic	Speculative	This is where the link contained in the email appears to be suspicious and has therefore been detected by link-following.
Link-W32/HackedPacker-Generic	Speculative	The executable is packed (compressed/obfuscated) in an unknown way.
MDB/Generic	Speculative	Generic detection designed to stop MDB (Microsoft Jet DataBase Engine) files that may be vulnerable to arbitrary code-execution attacks.
Office/Generic	Speculative	This is a speculative heuristic for malware in Microsoft Office documents.
PNG/Generic	Speculative	Generic detection of .png (portable network graphics) files that could potentially allow remote code execution.
VBS/Generic	Speculative	Exposed VBA code that directly affects areas of Windows, which is behavior seen previously within malware.
W32/Generic-	Speculative	This is when there are suspicious function calls within a document that can create and run a file.
W32/HackedPacker-MalProtector.gen	Speculative	The executable is packed (compressed/obfuscated) in an unknown way. It may contain self-modifying content.
W32/HackedPacker-UPX-	Speculative	An application that has been packed with a potentially malicious runtime packer or encryptor.
W32/Heur-Obfuscated.gen.d-	Speculative	Adware - A Trojan downloader that obscures itself so that you do not see it downloading malicious programs.
W32/Troj-Keylogger.gen-	Speculative	This is a means to obtain passwords or encryption keys and thus bypass other security measures that you may have in place.
W32/Troj-MalInstaller.gen-	Speculative	Setup installer that has Trojan-like strings that we have not been able to unpack.
W32/Troj-StartPage.gen-	Speculative	A Trojan that hijacks the Internet Explorer home page without your permission.
W32/Warezov-Heur	Speculative	The email contains many features of the mass-mailing virus Warezov.
W97M/Generic	Speculative	Macros within Office documents that call certain functions, which are commonly used to hide malicious activity. Can cause false positives due to the function calls.
WMF/Generic	Speculative	This is generic detection to prevent a vulnerability in Windows Meta File from being exploited.
X97M/Generic	Speculative	Macros within .xls documents that call certain functions, which are commonly used to hide malicious activity. Can cause false positives due to the function calls.
ZIP/Generic	Speculative	This is a generic detection of suspicious .zip files that can be used to hide malware.
Exploit/Unpacker	Speculative	We have been unable to unpack the contents of the mail due to the errors caused by the contents themselves.
Exploit/ArchiveRatio	Speculative	This is a corrupted archive. The files in the archive are too large for the ratio of the archive file.
Link-JS/Selfaltering	Speculative	This is usually a JavaScript link that has the ability to alter itself.
Exploit/Link-IFrame-	Speculative	This is an iframe (an HTM element that makes it possible to embed an HTML document inside another HTML document) that is hidden within the htm file of an email. It is designed to open a hidden iframe to download malicious content from a website, which is a specified link within the source code of the file.
HTML/IFrame	Speculative	This is a hidden iframe that has been appended to a HTML document that downloads malicious content from a website, which is specified within the source code of the file.
Word/Generic	Speculative	This is when there is suspicious shell code contained within a Word document.
EMF/Generic	Speculative	This is a generic detection to prevent a vulnerability in Generic vector graphics being exploited
Exploit/MimeBoundary	Speculative	This means that the mail has been stopped because there is more than one MIME boundary in the email, which violates https://datatracker.ietf.org/doc/html/rfc2822.
HHP/Generic	Speculative	This is a back-door Trojan that allows a remote intruder to gain access and control over the computer.
Malformed-Archive	Speculative	An archive file, such as a .zip file, that is not correctly formed
Exploit/MimeBoundary003	Speculative	This is where the MIME boundaries within the email do not match and have changed. This is usually indicative of a non-delivery report (NDR) or a broken email client. In a normal email these MIME boundaries should not change; therefore, this is suspicious behavior.
W32/Delf-Generic-xxxx-xxxx	Speculative	As a Trojan, this is a PE executable file that is packed with a UPX file compressor.
W32/Troj-ProcessInjector-xxxx-xxxx	Speculative	A Trojan that attempts to hide itself from virus scanners and injects its code into other processes running on the system.
W32/Memory-xxxx-xxxx	Speculative	This is a particular file that we have seen before that is likely a known malicious file.
Exploit/IFrame-xxxx	Speculative	This is a suspicious iframe that is hidden within the htm file of an email. The email is designed to open a hidden iframe to download malicious content.
Exploit/LinkExeFreehost-xxxx	Speculative	This is a link to an executable file that is hosted on a free hosting site that is known to host malicious content.
Exploit/MHTLink-	Speculative	This is a link to an MHTML document that has been archived as a Web page that can be used to host malicious content.
Image/AppendedHTML	Speculative	This is an image file that has had HTML commands or code appended to it that could be malicious.
Exploit/ImageAppendedHTML	Speculative	This is an image file that has had HTML commands or code appended to it that could be malicious.
Exploit/SuspiciousCHM	Speculative	This is when there is an HTML Help Compiled Help File that appears to have suspicious actions contained within it.
JS/Feebslike	Speculative	This is a polymorphic worm that has properties similar to the Feebs virus.
Link-Exploit-MSDDS	Speculative	This is a link to code attempting to exploit a Microsoft Internet Explorer vulnerability.
Link-Exploit/SuspLink	Speculative	These are links contained within an email that link to suspicious or executable files.
Link-JS/Decoder	Speculative	This is a link to decode JavaScript obfuscated code; however, this links to obfuscated JavaScript that may be malicious.
Link-JS/Generic	Speculative	This is a link to a site that contains JavaScript. The functions of the JavaScript have been used to obfuscate certain function calls within the code of the page.
Link-VBS/Psyme	Speculative	This is a link to a website that contains VBS/Psyme viral code that is designed to  infect your computer.
Link-W32/​HackedPacker-​MalProtector.gen-​xxxx-xxxx	Speculative	A link to an application that has been packed with a potentially malicious runtime packer or encryptor.
Office/Generic	Speculative	This is detection for suspicious code within Office attachments.
X97M/Marker.BM	Speculative	Macros within Microsoft Office .xls documents calling certain functions, which are commonly used to hide malicious activity. Can cause false positives due to the function calls.
XF/Generic	Speculative	This is where there is suspicious code contained within an .xls attachment.
Generic-xxxx	Speculative	This is detection for suspicious code within Office attachments.
Exploit/Generic!tt-xxxx	Speculative	This is a generic term for possible new malware threats that we will need to review. Some code can cause false positives; however, an example of what has been stopped under this name is fake UPS invoices that contain malware.
Exploit/EncryptedArchive	Speculative	The way in which the archive has been encrypted is suspicious.
Exploit/CAN-xxxx-xxxx	Speculative	These are known exploits that are out in the wild. Further information on these can be found by entering the full name on the following site [http://www.cve.mitre.org/cgi-bin/cvename.cgi?]
ZIP/Bagle!ZipBadCRC	Speculative	This is a .zip file that uses a Bagle-like password and that has a bad checksum (usually because of some form of corruption).
W32/Exploit-OLEHiddenEXE-xxxx	Speculative	This is an exploit where an embedded .exe can be hidden in a Word document (OLE file format). The .exe can be used to execute code or even download malicious content to a user's computer.
Outlook/DateExploit	Speculative	This is usually where the MIME header is incorrectly formatted and has the next line of header starting on the previous line next to the date.
ZIP/Generic.dam	Speculative	This is usually where there is a password-protected zip file that has been sent in an email that contains an image file. The image file could potentially contain the password, and so as a precaution we block this.