MALICIOUS — virussign.com_9d6149aca5bcf8b0b3126c9e38c6dc50.vir

MALICIOUS — virussign.com_9d6149aca5bcf8b0b3126c9e38c6dc50.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Downware family. 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0b99712acbe5395e08162a6fa69d48404cffbcfed1e9cb49a7ebd1946a8cc29a
SHA-1: dd4216530df56d6203e46695e1982b2f13bae40d
MD5: 9d6149aca5bcf8b0b3126c9e38c6dc50
imphash: c4c9ecfc26ca516a80b8f6f5b2bdb7e6
ssdeep: 96:hy859x0P8MaiE1RSHeBkzuDbZAZ3TYki3lk6S0WeGcR:F5oLE/S+BvnZAZ3Eki3ONMR
TLSH: T1AD1EF8D9F994A828C7B1FB453121EBCE723F9DCB2834817E9BC1C8552D007A3A166931
Submitted as: virussign.com_9d6149aca5bcf8b0b3126c9e38c6dc50.vir
File type: pe · Size: 7035 bytes
Verdict: malicious (97/100) · Family: Downware

Source: VirusSign · first seen 2026-07-16T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

ClamAV (daily): Win.Adware.Downware-251
Microsoft Defender: TrojanDownloader:Win32/Andromeda!pz
Kaspersky (KVRT): Worm.Win32.Debris.b
Trellix Stinger (McAfee): W32/Worm-FJV!9D6149ACA5BC

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Adware.Downware-251 (rule Win.Adware.Downware-251) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8128) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged TrojanDownloader:Win32/Andromeda!pz (rule TrojanDownloader:Win32/Andromeda!pz) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1516 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded domains

staging.to-do.officeppe.com
searchapp.bundleassets.example
www.msftconnecttest.com
config.edge.skype.com
www.bing.com
to-do.microsoft.com
ctldl.windowsupdate.com
settings-win.data.microsoft.com
dns.msftncsi.com
staging.to-do.microsoft.com
edge.microsoft.com
watson.events.data.microsoft.com
aps.prod.windows.com

More Downware samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report