MALICIOUS — virussign.com_5ed7b2bf8a04185c8ae4f7cadfcaa8e0.vir

MALICIOUS — virussign.com_5ed7b2bf8a04185c8ae4f7cadfcaa8e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Pvpk family. 5 of 53 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 0c850eb4a86db1426272638dbfa9e70effe5a15115871d11333611726f4b17a7
SHA-1: 3c66379ab1042db74cb66c2bc8e021e2e7ac4ae0
MD5: 5ed7b2bf8a04185c8ae4f7cadfcaa8e0
imphash: e780223af31e5cc3f52e2ebb06482260
ssdeep: 12288:A//kYD75DehQ24W+yiiHBVMdqXvyK6ZzLCrYQPLG:2zDtEQ25bMdyvypLOYl
TLSH: T1DF4B222F13497B5AF6631594C3BC6F5F0813E0A8B1E20749E249C7AC63E84775B72262
Submitted as: virussign.com_5ed7b2bf8a04185c8ae4f7cadfcaa8e0.vir
File type: pe · Size: 513827 bytes
Verdict: malicious (100/100) · Family: Pvpk

Source: VirusSign · first seen 2026-07-17T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

ClamAV (daily): Win.Malware.Pvpk-10056926-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Worm:Win32/Sfone!pz
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Pvpk-10056926-0 (rule Win.Malware.Pvpk-10056926-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7992) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Worm:Win32/Sfone!pz (rule Worm:Win32/Sfone!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PVPk!!prn!.FE0B916D (rule Dropped:Generic.Malware.PVPk!!prn!.FE0B916D) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

91945 behavior events · 2 ATT&CK techniques · 60 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3532/files/e2dc7176547a3a81c65d24ba6e2536106824fce3a73fe31a0ec41f4f41ab5fb2 - e2dc7176547a3a81c65d24ba6e2536106824fce3a73fe31a0ec41f4f41ab5fb2
/opt/CAPEv2/storage/analyses/3532/files/d3d7c6363beeb945b7b7374e95cc90283e67eda49fa22a29753dca6ca1eebbd0 - d3d7c6363beeb945b7b7374e95cc90283e67eda49fa22a29753dca6ca1eebbd0
/opt/CAPEv2/storage/analyses/3532/files/dbe778c5db496d1291f2e039f4738df16b6ee1a8a6d30db48bac0aa498cee618 - dbe778c5db496d1291f2e039f4738df16b6ee1a8a6d30db48bac0aa498cee618
/opt/CAPEv2/storage/analyses/3532/files/6c6fc65098d3b9166af08e39efe1571008854c8793198e40d5e1af1cfe75e3f4 - 6c6fc65098d3b9166af08e39efe1571008854c8793198e40d5e1af1cfe75e3f4
/opt/CAPEv2/storage/analyses/3532/files/8b3122facaa58d3969eb1f13084a56d20107a36f7bfbeffe72c55ba1a42a5218 - 8b3122facaa58d3969eb1f13084a56d20107a36f7bfbeffe72c55ba1a42a5218
/opt/CAPEv2/storage/analyses/3532/files/148f0338a62f373a6421460469609221e7760ffeec38e66522e60c2abefe30fa - 148f0338a62f373a6421460469609221e7760ffeec38e66522e60c2abefe30fa
/opt/CAPEv2/storage/analyses/3532/files/d2025e7d0f56b9eda046d43ed34a387130b7bbe1aef9be26b09fcd85b81fbcbd - d2025e7d0f56b9eda046d43ed34a387130b7bbe1aef9be26b09fcd85b81fbcbd
/opt/CAPEv2/storage/analyses/3532/files/db8a8df325ad59e2ec90a9f009586f81d4bd66cfc5e1bfe8a501e6e0149534c5 - db8a8df325ad59e2ec90a9f009586f81d4bd66cfc5e1bfe8a501e6e0149534c5
/opt/CAPEv2/storage/analyses/3532/files/3c9e183ffbd3241770ca628bb7dc4b58f498b992f0456fbde83fb8483b4626b0 - 3c9e183ffbd3241770ca628bb7dc4b58f498b992f0456fbde83fb8483b4626b0
/opt/CAPEv2/storage/analyses/3532/files/28227dc7b17febe2dfff5f3c20a7b5d244cab6ca489775615816fb30d6cbf392 - 28227dc7b17febe2dfff5f3c20a7b5d244cab6ca489775615816fb30d6cbf392
/opt/CAPEv2/storage/analyses/3532/files/18d8e5f1efeb98eb5eceab5d2d14c8beb08b350b4682b402645734cec4f1c9d9 - 18d8e5f1efeb98eb5eceab5d2d14c8beb08b350b4682b402645734cec4f1c9d9
/opt/CAPEv2/storage/analyses/3532/files/fcf4ddf6567faab536716dc586124f35315ed7cd27452ce648ced26c77270315 - fcf4ddf6567faab536716dc586124f35315ed7cd27452ce648ced26c77270315
/opt/CAPEv2/storage/analyses/3532/files/37f791a3a120f1d50caefe94cdc7f79a31df02dc974ca55d875e82eb91279805 - 37f791a3a120f1d50caefe94cdc7f79a31df02dc974ca55d875e82eb91279805
/opt/CAPEv2/storage/analyses/3532/files/f89a5e07d1433f96bd7a69832dad89530b86a78e409517883a85111b359a3773 - f89a5e07d1433f96bd7a69832dad89530b86a78e409517883a85111b359a3773
/opt/CAPEv2/storage/analyses/3532/files/677e1f88af170eb14634ec959ae18fd4753576f5e23549bc4d46f222cb016424 - 677e1f88af170eb14634ec959ae18fd4753576f5e23549bc4d46f222cb016424

Embedded domains

searchapp.bundleassets.example
www.msftconnecttest.com
config.edge.skype.com
settings-win.data.microsoft.com
www.bing.com
dns.msftncsi.com
msedge.api.cdp.microsoft.com
edge.microsoft.com
ecs.office.com
g.live.com
fs.microsoft.com
www.msftncsi.com
self.events.data.microsoft.com
aps.prod.windows.com
watson.events.data.microsoft.com

File paths

S:\1B%

More Pvpk samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report