MALICIOUS — virussign.com_aaa27d3158ba43af03687506585572a0.vir

MALICIOUS — virussign.com_aaa27d3158ba43af03687506585572a0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the BlackMoon family. 6 of 51 detection engines flagged it.

Identification

SHA-256: 0b5dc234895fde21c8ed1a3c32d2ddef1772225e61e59b8eb4249a3b154adeb4
SHA-1: 05dae2bbf77a16e80ffb0ce82178fe4285f30fcb
MD5: aaa27d3158ba43af03687506585572a0
imphash: 9dacd5fc505421be83fd9ef325d44b59
ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5U:0cdpeeBSHHMHLf9RyIEQ5KXZ3
TLSH: T1A3390AA396A3B489C93470AB3B4F7351B000BDF00653799665ACE29FBD635CB46834C6
Submitted as: virussign.com_aaa27d3158ba43af03687506585572a0.vir
File type: pe · Size: 91518 bytes
Verdict: malicious (91/100) · Family: BlackMoon

Source: VirusSign · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (6 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Trojan:Win32/Blackmoon!rfn
Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn

Why this verdict

The malicious score of 91/100 is the fusion of 3 weighted signals:

ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report