MALICIOUS — virussign.com_0949d1cbd7efaea590f5d027c0314930.vir

MALICIOUS — virussign.com_0949d1cbd7efaea590f5d027c0314930.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100). 1 of 55 detection engines flagged it.

Identification

SHA-256: 1faf10d1a1bbe1e1826a0599e2a98c9c0a81033bba1f20880aba3880d47df7f9
SHA-1: 0095d76371dd7470a17113a6938ede8a47a4cdad
MD5: 0949d1cbd7efaea590f5d027c0314930
imphash: 44140cbbe125df54636c585913f74c75
ssdeep: 98304:axo0K8uDGrIgKPXRxGO7iSOHADRIHBjc:axox8u6rUPXRxGOgAtIh
TLSH: T1A66322A6B4253DBADD35F7751D1E356D08EAB006C0D984CCA382AC8B9580D5B87F84F2
Submitted as: virussign.com_0949d1cbd7efaea590f5d027c0314930.vir
File type: pe · Size: 4747264 bytes
Verdict: malicious (71/100)

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (1 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.!|&

Why this verdict

The malicious score of 71/100 is the fusion of 3 weighted signals:

Memory forensics: 5 finding(s), e.g. RWX/private injected region in tsk_85f2d9ab1d (pid 488) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 27 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.!|& - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

11 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787768507&P2=404&P3=2&P4=at8792CJrS%2buH%2bgiEeOVYqXYbdpfQUAk8XuXuYUN03Uhuph8wYEv5oveLEQM%2brc1Dwx9aSU0sAwk0I018zNZaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787768559&P2=404&P3=2&P4=JvHUKMA9uLrmMtriKpi0bNREnlNyBuUXLGig66WP8v3U0%2bx1eKejTVZY%2b5KI9HBbsoQ24Zd19MgkFKQ2pu6RGQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787165320&P2=404&P3=2&P4=TJPR9RngEMnIHbkf2d%2fw9L3G%2fsO9RznNYL2En8dfQoH%2brlyIGaBsggm5RD9TPCgNYIqaY1V%2fL4fjDEfmJPCQqA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787164819&P2=404&P3=2&P4=ATjMgUBo8cloW1xqKeu7JfccaDls%2fHpHJMAIpl9exI5knsm3ioqd7%2b4wRYtprVKnudbW5VPGh6j98U0r8W1y4g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

0s.ml

Embedded IP addresses

52.110.12.49
52.110.12.54
20.184.175.0
20.247.184.197
40.84.85.40
4.230.171.124
135.233.95.144
74.179.77.164
4.150.223.106
4.150.223.99
20.76.201.171
40.103.64.242
162.159.142.9
52.123.128.14
172.178.240.163
203.26.79.13
135.232.92.34
4.150.223.103
20.50.73.5
52.148.114.188
92.223.78.30
72.154.7.106
135.234.160.245
48.199.12.1
20.184.175.17

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report