MALICIOUS — virussign.com_0d773d927989a5d6fd0d6faa22b84e30.vir

MALICIOUS — virussign.com_0d773d927989a5d6fd0d6faa22b84e30.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Virlock family. 6 of 52 detection engines flagged it.

Identification

• SHA-256: 104af7079152e052cf3c9f563bf837afee6ffac2662780f6a0bc1f8002a17eeb
• SHA-1: 29143aed8a446a32599f99be8eb1bc6677e18dea
• MD5: 0d773d927989a5d6fd0d6faa22b84e30
• imphash: c9a388aee28a794c64992b1a9d2409e8
• ssdeep: 49152:9T0KmqC/OLau2EvhbICqNcWWyz4zhAXqNTII2qo8R20RJBMMMnq0kmVR9c:h02C/OLau2QqNcWUz2qNTIIIi28BMMMe
• TLSH: T1785EF1EB0E632834F84545244940CCCD1E7EE8E9E2A8D14B877B9C01BB89DB7D46A35D
• Submitted as: virussign.com_0d773d927989a5d6fd0d6faa22b84e30.vir
• File type: pe · Size: 3067392 bytes
• Verdict: malicious (87/100) · Family: Virlock

Source: VirusSign · first seen 2026-08-07T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Virus.Virlock-6332874-0
• Microsoft Defender: Trojan:Win32/Mikey.HNB!MTB
• Emsisoft (Emergency Kit): Win32.Virlock.Gen.1
• Trellix Stinger (McAfee): W32/VirRansom.b
• Kaspersky (KVRT): Virus.Win32.PolyRansom.b

Why this verdict

The malicious score of 87/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Virus.Virlock-6332874-0 (rule Win.Virus.Virlock-6332874-0) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More Virlock samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report