SUSPICIOUS — virussign.com_578fb0e0d5edc504cac73069cf13c9e0.vir

SUSPICIOUS — virussign.com_578fb0e0d5edc504cac73069cf13c9e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (65/100), attributed to the Maldoc family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 1809a74e44aa3c6549f3050e833a3cecbf035e00e7fe5da9f3a9f1e96fb7fda6
• SHA-1: 887099fd9b5224d999a6041bd287865146d9a6a5
• MD5: 578fb0e0d5edc504cac73069cf13c9e0
• imphash: 350c15ccc5e8bc9c9989e20f380e23fa
• ssdeep: 6144:1v9/qzrnuGXBCzraOjHElFsRdOsNtns8ciWPbDm6N9RFf0nq:1g49H6CRgsNtbAd
• TLSH: T1F74B07CD062E6701D73ACB245D246EED98A4B4C8217A7A4D0F57897E12E3027FD3186E
• Submitted as: virussign.com_578fb0e0d5edc504cac73069cf13c9e0.vir
• File type: pe · Size: 485376 bytes
• Verdict: suspicious (65/100) · Family: Maldoc

Source: VirusSign · first seen 2026-08-11T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• capa (capabilities): capability:collection/keylog
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Trojan:Win32/Lazy.VGZ!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Midie.180229
• Kaspersky (KVRT): HEUR:Trojan.Win32.Loader.gen

MITRE ATT&CK

• T1071.001
• T1056.001

Why this verdict

The suspicious score of 65/100 is the fusion of 4 weighted signals:

• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.adobe.com/go/acrobat_system_reqs_ae
• http://www.adobe.com/go/acrobat_system_reqs
• http://www.adobe.com/go/acrobat_system_reqs_cn
• http://www.adobe.com/go/acrobat_system_reqs_tw
• http://www.adobe.com/go/acrobat_system_reqs_hr
• http://www.adobe.com/go/acrobat_system_reqs_cz
• http://www.adobe.com/go/acrobat_system_reqs_dk
• http://www.adobe.com/go/acrobat_system_reqs_nl
• http://www.adobe.com/go/acrobat_system_reqs_fi
• http://www.adobe.com/go/acrobat_system_reqs_fr
• http://www.adobe.com/go/acrobat_system_reqs_de
• http://www.adobe.com/go/acrobat_system_reqs_il
• http://www.adobe.com/go/acrobat_system_reqs_hu
• http://www.adobe.com/go/acrobat_system_reqs_it
• http://www.adobe.com/go/acrobat_system_reqs_jp
• http://www.adobe.com/go/acrobat_system_reqs_kr
• http://www.adobe.com/go/acrobat_system_reqs_no
• http://www.adobe.com/go/acrobat_system_reqs_pl
• http://www.adobe.com/go/acrobat_system_reqs_br
• http://www.adobe.com/go/acrobat_system_reqs_ro
• http://www.adobe.com/go/acrobat_system_reqs_ru
• http://www.adobe.com/go/acrobat_system_reqs_sk
• http://www.adobe.com/go/acrobat_system_reqs_si
• http://www.adobe.com/go/acrobat_system_reqs_es

Embedded domains

• schemas.microsoft.com
• www.adobe.com
• afsluttes.se
• avsluttes.se

File paths

• D:\DCB\CBT_Main\Acrobat\Installers\BootStrapExe_Small\Release\Setup.pdb
• f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report