{
  "family": "filerepmalware",
  "sample_count": 45,
  "category": "trojan",
  "description": "Win32:FileRepMalware is a broad, generic heuristic detection primarily utilized by the Avast and AVG antivirus engines. It does not identify a specific malware family; rather, it indicates that a downloaded executable has an exceptionally low 'reputation score' within the vendor's global threat intelligence cloud.<br><br><b>Understanding FileRepMalware</b><br>To the end-user, this is a standard antivirus block, often occurring immediately after downloading a file. For a security analyst, a 'FileRepMalware' detection means the AV engine lacks a specific signature for the file, but blocked it based on metadata. The 'Reputation' score is calculated using factors such as: How many users globally have downloaded this file? (If it's very few, it's suspicious). Is the file digitally signed by a trusted publisher? How new is the file? Was it downloaded from a domain known for hosting malware?<br><br><b>Execution and Threat Hunting</b><br>Because it is a reputation-based heuristic, the infection vector varies. It is frequently triggered by newly compiled, custom malware (which inherently has zero reputation), very rare adware, or sometimes, poorly coded legitimate software (False Positives). If the file executes, threat hunters must rely entirely on EDR telemetry to trace its behavior. Did it attempt to inject code (`T1055`)? Did it establish an outbound connection to an unknown IP (`T1105`)? The AV engine blocked it *preventatively* before it could exhibit these behaviors.<br><br><b>Forensic Analysis & Impact</b><br>The impact is dependent on the true nature of the payload. Incident responders cannot rely on the 'FileRepMalware' name for attribution. The immediate focus must be on obtaining the quarantined binary. Dynamic analysis in a sandbox (like Cuckoo) is essential to determine if the low-reputation file is genuinely malicious (e.g., a novel trojan) or simply a benign, unsigned application.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1204.002",
    "T1027",
    "T1036",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1036",
      "name": "Masquerading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Verify that the AV engine successfully quarantined the low-reputation file and that no child processes were spawned prior to the block.",
    "Extract the quarantined binary securely and submit it to a dynamic analysis sandbox or VirusTotal to determine its true behavior.",
    "Review EDR logs to trace the origin of the file (e.g., was it downloaded via a browser, dropped by a macro, or executed from a USB?).",
    "If the file is determined to be a False Positive (e.g., a custom internal corporate app), whitelist its hash in the AV console."
  ],
  "what_to_avoid": [
    "Do not assume the threat is minor simply because it lacks a specific family name; reputation blocks often catch novel, previously unseen zero-day threats.",
    "Avoid closing the incident without determining *how* the suspicious binary arrived on the endpoint."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}