MALICIOUS — virussign.com_d113f05fea5d484a6475862bb71c9720.vir

MALICIOUS — virussign.com_d113f05fea5d484a6475862bb71c9720.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HTML family. 3 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 101f3686b67b8d3c3b1194915f6f1c4b3a598e324d43681dc2c825849e100082
• SHA-1: 2a51b61f5a2338804a730885126cc57b5a850f4c
• MD5: d113f05fea5d484a6475862bb71c9720
• ssdeep: 1536:s5IRIOITIwIgIWKZgNDfIwIGI5I0J7SAIRIOITIwIgIHKZgNDfIwIGI5ITJ7Sa1L:S1DWqw1Q89ySSL
• TLSH: T1F043FE45AD876A8E9183045E92620FC4B14CE91910D6E7EBF0E09D1FCE97714C2AE1FB
• Submitted as: virussign.com_d113f05fea5d484a6475862bb71c9720.vir
• File type: html · Size: 225659 bytes
• Verdict: malicious (99/100) · Family: HTML

Source: VirusSign · first seen 2026-07-09T00:00:00.000Z · SHA-256 verified

Detections (3 of 51 engines)

• Microsoft Defender: Trojan:HTML/Phish.B!atmn
• Emsisoft (Emergency Kit): GT:JS.ObfscRed.2.4441F5DC
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1112
• T1071.004

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

• Microsoft Defender flagged Trojan:HTML/Phish.B!atmn (rule Trojan:HTML/Phish.B!atmn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged GT:JS.ObfscRed.2.4441F5DC (rule GT:JS.ObfscRed.2.4441F5DC) - engine signal, weight 0.55, confidence 0.85
• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Obfuscated javascript script: dynamic-exec, defense-evasion (layers: char-code+concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• 1 behavioral detection(s): Possible DNS tunneling (long/many queries) [medium] (rule tl-dns-tunneling) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Possible DNS tunneling (long/many queries) [medium] (rule tl-dns-tunneling) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 39 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Contacted 39 external host(s) at runtime (8 HTTP) - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: http://ogp.me/ns/fb#, http://ios-data-recover.com/wp-content/uploads/2014/05/iphone-broken.png, https://imobie-resource.com/en/support/img/recover-messages-from-water-damaged-iphone-6.png - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

14200 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• outlook.cloud.microsoft
• www.msftconnecttest.com
• searchapp.bundleassets.example
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 61.240.178.74.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• wpad
• settings-win.data.microsoft.com
• login.live.com
• ocsp.digicert.com
• v10.events.data.microsoft.com
• 209.52.40.23.in-addr.arpa.
• 157.37.11.23.in-addr.arpa.
• 160.14.126.40.in-addr.arpa.
• 85.65.42.20.in-addr.arpa.
• 224.104.155.57.in-addr.arpa.

Embedded URLs

• http://ogp.me/ns/fb#
• http://ios-data-recover.com/wp-content/uploads/2014/05/iphone-broken.png
• https://imobie-resource.com/en/support/img/recover-messages-from-water-damaged-iphone-6.png
• https://www.anysoftwaretools.com/wp-content/uploads/overlay-pictures2-300x294.png
• https://www.restore-iphone-data.com/wp-content/uploads/2016/04/recover-iphone-data-after-water-damaged-stolen-broken-300x146.jpg
• https://seriesbrasil.com.br/wp-content/uploads/2020/08/poster-bom-dia-veronica-netflix-691x1024.png
• https://wallpapercave.com/wp/wp8142035.jpg
• https://seriesbrasil.com.br/wp-content/uploads/2021/10/ggcon.png
• https://fsmedia.imgix.net/da/f5/ed/71/f6c6/48e9/895c/4b062ecaef29/promotional-art-for-the-legend-of-vox-machina-featuring-the-characters-of-critical-roles-vox-ma.jpeg
• http://images2.fanpop.com/image/photos/13600000/The-English-Patient-Picspam-the-english-patient-13664360-786-525.jpg
• https://static.filmvandaag.nl/covers/3000/3508.jpg
• https://travelerjuli.weebly.com/
• https://cdn2.editmysite.com/js/jquery-1.8.3.min.js
• https://www.google.com/recaptcha/api.js
• https://mytefoundry.weebly.com/blog/lies-of-p-concept-art
• https://babesyare.weebly.com/blog/omegle-similar-sites
• https://batmansearch.weebly.com/blog/trump-golf-course-locations
• https://travelerjuli.weebly.com/2/post/2023/08/retrieve-data-from-water-damaged-iphone.html
• http://twitter.com/share?url=https://travelerjuli.weebly.com/2/post/2023/08/retrieve-data-from-water-damaged-iphone.html
• https://dikiea.weebly.com/blog/az-game-and-fish-locations
• https://hopworthy.weebly.com/blog/walmart-star-wars-monopoly
• https://travelerjuli.weebly.com/2/post/2023/08/critical-role-amazon.html
• http://twitter.com/share?url=https://travelerjuli.weebly.com/2/post/2023/08/critical-role-amazon.html
• https://grosviews.weebly.com/blog/tot-sa-stock
• https://gatemumu.weebly.com/blog/master-reboot-ending-puzzles

Embedded domains

• ogp.me
• ios-data-recover.com
• imobie-resource.com
• www.anysoftwaretools.com
• www.restore-iphone-data.com
• seriesbrasil.com.br
• wallpapercave.com
• fsmedia.imgix.net
• images2.fanpop.com
• static.filmvandaag.nl
• travelerjuli.weebly.com
• cdn2.editmysite.com
• cdn1.editmysite.com
• www.weebly.com
• www.google.com
• mytefoundry.weebly.com
• babesyare.weebly.com
• batmansearch.weebly.com
• twitter.com
• dikiea.weebly.com
• hopworthy.weebly.com
• grosviews.weebly.com
• gatemumu.weebly.com
• 2.bp.blogspot.com
• media.comicbook.com

Embedded IP addresses

• 57.155.101.212
• 23.40.52.85
• 52.123.252.241
• 74.178.240.61
• 57.155.104.224
• 23.40.52.209
• 20.42.65.85
• 199.232.138.172
• 23.214.54.132
• 52.168.117.175
• 40.126.14.160
• 72.145.35.115
• 23.221.133.182
• 74.178.232.29
• 13.89.179.12
• 203.26.79.13
• 48.211.4.16
• 20.42.65.91
• 4.247.188.224
• 172.172.255.218
• 4.150.223.104
• 172.215.188.232
• 150.171.22.17
• 23.221.133.123
• 85.210.196.11

File paths

• C:\Program

More HTML samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report