MALICIOUS — virussign.com_48c0e26ac37f6dd4655e37f9586fe390.vir

MALICIOUS — virussign.com_48c0e26ac37f6dd4655e37f9586fe390.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Autorun family. 7 of 52 detection engines flagged it.

Identification

• SHA-256: 15d6f8ef2635894bdb1aac4b951e52bcab86a74f65477e5202ef09a9b0b80518
• SHA-1: b59b97d3efcab91e21c6820100c3766458a92a54
• MD5: 48c0e26ac37f6dd4655e37f9586fe390
• imphash: 178689c38c1294cbf87aafcafb2357ed
• ssdeep: 49152:q9C0X5pR8AbNcqQtDybOzb4AOd9CGpoobW0Iftc:qpv8ABcqUJzrOd9CGpBbWdtc
• TLSH: T1675933F9B709E86CF7D350067A7382AD927EC9446306CD11A2407E908B338D72699A67
• Submitted as: virussign.com_48c0e26ac37f6dd4655e37f9586fe390.vir
• File type: pe · Size: 1947111 bytes
• Verdict: malicious (98/100) · Family: Autorun

Source: VirusSign · first seen 2026-07-30T00:00:00.000Z · SHA-256 verified

Detections (7 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Worm.Socks-9892592-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:UPX 3.02
• Microsoft Defender: Worm:Win32/Autorun
• Emsisoft (Emergency Kit): Trojan.Stealer.557
• Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Blocker.gen

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

• ClamAV (daily) flagged Win.Worm.Socks-9892592-0 (rule Win.Worm.Socks-9892592-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Worm:Win32/Autorun (rule Worm:Win32/Autorun) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Stealer.557 (rule Trojan.Stealer.557) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX 3.02 (rule DIE:UPX 3.02) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX, high-entropy-sections:UPX1, UPX 3.02 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report