MALICIOUS — virussign.com_c0c77ea799d17d16925eebb798aa9830.vir

MALICIOUS — virussign.com_c0c77ea799d17d16925eebb798aa9830.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Downware family. 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 013ce2e5ada39179855e4db3415865d05dc6ac9d98fad02db6240741dd6cd4b3
SHA-1: 0413892f1a0a82c601635012f01d55efd00aac6a
MD5: c0c77ea799d17d16925eebb798aa9830
imphash: 33eb74cdd77dab1b168bbaa130115a9d
ssdeep: 96:DixZjmjtjd8jPjcZGR5TICpDkhBuIXsZFaZIu:unSR6bgYlDecZFSv
TLSH: T10F1DF0DB106DB40CCBDDA41DE5B1D7DD26A4A4AF303507A0C684843C9826AAFD25F932
Submitted as: virussign.com_c0c77ea799d17d16925eebb798aa9830.vir
File type: pe · Size: 6035 bytes
Verdict: malicious (97/100) · Family: Downware

Source: VirusSign · first seen 2026-07-08T00:00:00.000Z · SHA-256 verified

Detections (3 of 53 engines)

ClamAV (daily): Win.Adware.Downware-316
Microsoft Defender: flagged
Kaspersky (KVRT): Worm.Win32.Debris.b

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Adware.Downware-316 (rule Win.Adware.Downware-316) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7880) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1519 behavior events · 1 ATT&CK techniques · 0 dropped files.

More Downware samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report