MALICIOUS — virussign.com_39415367ed216b84c10eb5cbfe8163b0.vir

MALICIOUS — virussign.com_39415367ed216b84c10eb5cbfe8163b0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sality family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1988aadcdf290193a55c2cb6f25a769f020bb5ff4ef7036ae1a559072faf2f2a
SHA-1: e6fbf190d8dd0f74e2c8f99c4f4fee7aa91b345e
MD5: 39415367ed216b84c10eb5cbfe8163b0
imphash: 46646950e38cdd1519d35c0c539d2b12
ssdeep: 1536:erxQedQn84/qk2uUf6pcbqn1JxvcftDFBr1VxOe/W:mQnFqkoSpciJtcftJ1W
TLSH: T1D6360212231835A2C44BEB79512E7EAD994C4716F058CE63C9C094426BF91B3EA31DBF
Submitted as: virussign.com_39415367ed216b84c10eb5cbfe8163b0.vir
File type: pe · Size: 66561 bytes
Verdict: malicious (100/100) · Family: Sality

Source: VirusSign · first seen 2026-07-16T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Virus.Sality-6301347-0
Microsoft Defender: Virus:Win32/Sality.AT
Emsisoft (Emergency Kit): Trojan.SalityStub.F
Kaspersky (KVRT): Virus.Win32.Sality.sil

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Virus.Sality-6301347-0 (rule Win.Virus.Sality-6301347-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. RWX/private injected region in powershell.exe (pid 2512) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Sality.AT (rule Virus:Win32/Sality.AT) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.SalityStub.F (rule Trojan.SalityStub.F) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

35840 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3465/files/c4620a7256371cf52fc86a9b66eb175b80431945e87da9787935f3e067eef83c - c4620a7256371cf52fc86a9b66eb175b80431945e87da9787935f3e067eef83c
/opt/CAPEv2/storage/analyses/3465/files/97f5c5aec5f2deece61e6b922fd46c285a5c7e602b66fdacdf5c1fd6df671a09 - 97f5c5aec5f2deece61e6b922fd46c285a5c7e602b66fdacdf5c1fd6df671a09
/opt/CAPEv2/storage/analyses/3465/files/71d62df1161fe90faa2c3917bfbb4bbb4339bc15ad979e933199a29dcf9a8f5f - 71d62df1161fe90faa2c3917bfbb4bbb4339bc15ad979e933199a29dcf9a8f5f
/opt/CAPEv2/storage/analyses/3465/files/dab66fd98cc0b3404f667387089070794ea5c09bdf10b7b76401b3afef5c9a10 - dab66fd98cc0b3404f667387089070794ea5c09bdf10b7b76401b3afef5c9a10
/opt/CAPEv2/storage/analyses/3465/files/fe5fd61688a71904f3bf73a05b579dab2dc9baa472338537209510456206efc1 - fe5fd61688a71904f3bf73a05b579dab2dc9baa472338537209510456206efc1
/opt/CAPEv2/storage/analyses/3465/files/6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b - 6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b
/opt/CAPEv2/storage/analyses/3465/files/e1513e6ab525dfd455416af474c6c826f413126c8b996fd586141c99240517f5 - e1513e6ab525dfd455416af474c6c826f413126c8b996fd586141c99240517f5
/opt/CAPEv2/storage/analyses/3465/files/54b178ff6b3ae9ecdbbd71d70215e5b820639d59e3f9c0f73073051568544510 - 54b178ff6b3ae9ecdbbd71d70215e5b820639d59e3f9c0f73073051568544510
62375771444e16f9b2b889ca44474a6af2ae4fa3f15ccd8b1d016ee29beb50f4 - 62375771444e16f9b2b889ca44474a6af2ae4fa3f15ccd8b1d016ee29beb50f4
2c74c4c828dbdfb69f37dfc37435155fcc301908ff567869043aed1f99cf059a - 2c74c4c828dbdfb69f37dfc37435155fcc301908ff567869043aed1f99cf059a
f480c2b8b56ccf10319f5064640904d2521a8fbaf81468b57fc3e3e98a5b50d2 - f480c2b8b56ccf10319f5064640904d2521a8fbaf81468b57fc3e3e98a5b50d2
94d0683cb72aaa069612de5522a00f534851cd63ac5b6006c194b73735896d9a - 94d0683cb72aaa069612de5522a00f534851cd63ac5b6006c194b73735896d9a
deba226d8b4e780961d61f152dfd1b957c37a15418410220f21ebf2810f61fef - deba226d8b4e780961d61f152dfd1b957c37a15418410220f21ebf2810f61fef
a9e23459375b1234a851538e8de666bf23d47fa3d0ccf63b2c96f2f2205bf1fe - a9e23459375b1234a851538e8de666bf23d47fa3d0ccf63b2c96f2f2205bf1fe
abe22e36a3e989fba109ca849fcef7a54e31b06f51f9586479b04c5171afe027 - abe22e36a3e989fba109ca849fcef7a54e31b06f51f9586479b04c5171afe027

Embedded domains

www.msftconnecttest.com
watson.events.data.microsoft.com
www.bing.com
dns.msftncsi.com
edge.microsoft.com
config.edge.skype.com
aps.prod.windows.com
msedge.api.cdp.microsoft.com
fs.microsoft.com
www.msftncsi.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com

More Sality samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report