Mal/FunDF

Mal/FunDF indicates that Sophos has detected a script that uses encryption or obfuscation techniques commonly associated with malicious activity.

This detection is applied to scripts that encrypt or conceal their content to prevent analysis. These techniques are frequently used by malicious software to evade detection, hide behavior, or deliver additional threats.

Scripts detected as Mal/FunDF may:

• Obfuscate or encrypt their contents to avoid inspection by security tools
• Download, unpack, or execute additional malicious components
• Conceal behavior intended to compromise system security or user data

While encryption or obfuscation can have legitimate uses, in this context it is most often used to disguise malicious or unwanted functionality.

Because this detection is based on the use of these techniques, it may include malicious, unwanted, or otherwise suspicious scripts depending on context.

If you believe this detection is incorrect, please report the file to Sophos Support. You can also submit samples for further analysis.