MALICIOUS — virussign.com_34f2220d711d3657377fa2a68ba3be20.vir

MALICIOUS — virussign.com_34f2220d711d3657377fa2a68ba3be20.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 5 of 55 detection engines flagged it.

Identification

SHA-256: 12d87f2fe01a7c4a6e38e256174069a23158ff0de8d2dfb9fd82347d8399b58e
SHA-1: caa3eea1ede3e2c754ea1841d81a557069f4c179
MD5: 34f2220d711d3657377fa2a68ba3be20
imphash: cdad71f00be06ad1b130e995c45f78b1
ssdeep: 3072:LKQZoIUE0I08UnG/4Pb4fafhcZww3xhr8EHeWXz377pcsMn9H0l6:LKCoG5UnfPMfafE70E77W9n9H
TLSH: T1094BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C689A7F17F7B98C5E1
Submitted as: virussign.com_34f2220d711d3657377fa2a68ba3be20.vir
File type: pe · Size: 479346 bytes
Verdict: malicious (93/100)

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Trellix Stinger (McAfee): Trojan-JBCL!34F2220D711D
Kaspersky (KVRT): Trojan.Win32.VB.dosq

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Contacted 27 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

18832 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/Resou
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787768323&P2=404&P3=2&P4=XzudGXX4ueW3JTRzOLimBpyH9C9Ecm6ZiqmDwY25fGVPDwMDW%2fC2kXXIJDG6%2fVZ0aQLIBhLp%2f%2bMayA16PTIhaQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787768356&P2=404&P3=2&P4=Xxpb4yMPMhDK0Wgj6Er4zwLfEPRnxUOtgCMSc1HBw6twnE%2bp9O53F5FUbnzwxR1jQKVKYwTHc6LX2D0rBQqkPA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

52.123.252.227
74.179.71.159
13.89.179.15
52.123.252.213
52.123.252.235
57.155.104.224
4.230.171.124
52.230.59.222
74.179.77.204
20.165.94.54
51.11.192.51
203.26.79.13
20.89.1.8
20.236.44.162
52.123.129.14
40.103.64.226
162.159.142.9
135.234.160.245
135.233.45.221
52.148.114.188
52.110.12.25
92.223.78.30
72.153.5.136
48.211.4.16
40.84.85.40

File paths

C:\Program

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report