SUSPICIOUS — virussign.com_963771127a870a35ae9e36da28db9380.vir
SUSPICIOUS — virussign.com_963771127a870a35ae9e36da28db9380.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
029cbdba6fc658a16fdf3366a3288dd8f16b761cdb31c8c7026ba4195c944bf0 - SHA-1:
3da8039adae924cd4590e8fe005e1638d82f0c5f - MD5:
963771127a870a35ae9e36da28db9380 - ssdeep:
768:bS7s5ssD/0bT5ugg15aTwM0bT5ugg15aTwmbWdRYMZRpdsZ:fAT5ugg15aTwMAT5ugg15aTwmbWgMZy - TLSH:
T1EC34D7CA3D4B0A47D40C6D51B89CB8A47DDEE26BD82088E6C5A9D78CCCD4958BF4D834 - Submitted as: virussign.com_963771127a870a35ae9e36da28db9380.vir
- File type: html · Size: 53802 bytes
- Verdict: suspicious (54/100)
Source: VirusSign · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified
Detections (0 of 50 engines)
No engine flagged this sample.
MITRE ATT&CK
Why this verdict
The suspicious score of 54/100 is the fusion of 5 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Contacted 45 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: https://random-affiliate.atimaze.com/, https://images.purevpnaffiliates.com, https://s-img.adskeeper.com/ - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (10 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
274 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- b40cdb8730a2c8164c92f3dae9b6cfe4cce520367215b58f86261b8fd3b13b54 -
b40cdb8730a2c8164c92f3dae9b6cfe4cce520367215b58f86261b8fd3b13b54
Embedded URLs
- https://random-affiliate.atimaze.com/
- https://images.purevpnaffiliates.com
- https://s-img.adskeeper.com/
- https://paid.outbrain.com/network/redir
- https://rcm-fe.amazon-adsystem.com/
- http://yfdpco4.com/sk-park.php?pid=9PO15V947&
- http://yfdpco4.com/sk-park.php?pid=9PO15V947&dn=myclapp.com&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F141.0.7390.37+Safari%2F537.36&ip=90.187.238.0&xfip=90.187.238.0&requrl=http%3A%2F%2Fww80.myclapp.com%2F%3Fsubid1%3Da15d8f3a-8032-11f1-a337-d5b6e8474e92
- https://euob.northwavepoint.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.js
- https://obseu.northwavepoint.com/ns/636f8b858f681acb7bfa6f583a96630a.html?ch=AdsDeli%20-%20iFrame
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1787061452&P2=404&P3=2&P4=KKdcrCdVy9YyyLqvNVLWDXa0ACcteAoFOUtGUAbVFKj0aEuSeMy6KA%2foIits5mj6nuBV1hlFDFr3C3HaEYa50g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9?P1=1787061514&P2=404&P3=2&P4=gX%2bfgKddlTcl5CdP9ehXY8Zx8ES5KB71LYCprmiVXXau2W%2bapJMX199LdDf6uvKYnkhnG2Zwyi16nrCae%2bZnUg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- myclapp.com
- random-affiliate.atimaze.com
- images.purevpnaffiliates.com
- s-img.adskeeper.com
- paid.outbrain.com
- wallpaperaccess.com
- body.no
- rcm-fe.amazon-adsystem.com
- div.app
- div.cc
- div.dev
- div.edu
- div.eu
- passtechusa.com
- yfdpco4.com
- n.link
- e.link
- euob.northwavepoint.com
- obseu.northwavepoint.com
Embedded IP addresses
- 90.187.238.0
- 40.84.85.40
- 4.150.223.114
- 20.247.185.124
- 4.230.171.124
- 4.247.188.224
- 74.179.77.204
- 4.150.223.98
- 74.178.240.51
- 52.168.117.169
- 52.123.252.248
- 135.232.92.34
- 52.123.252.203
- 40.104.4.2
- 20.231.239.246
- 92.223.78.30
- 162.159.142.9
- 52.123.129.14
- 52.123.128.14
- 203.26.79.13
- 172.178.240.161
- 52.148.114.188
- 135.234.160.246
- 72.154.7.109
- 52.110.12.42
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report