MALICIOUS — virussign.com_603162643308fdd6cd71c7b144233780.vir

MALICIOUS — virussign.com_603162643308fdd6cd71c7b144233780.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PolyRansom family. 6 of 52 detection engines flagged it.

Identification

• SHA-256: 21e881bd5d1fc7961b42bab401a9e8d0ba8b5e30906cc9418a632704068ffc17
• SHA-1: 9ecead3f5918a3db9e81fba7f4aabee905606f8a
• MD5: 603162643308fdd6cd71c7b144233780
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 3072:n/tqqzMshd8H7rPFHxvfQBi+cTE5zEGvSmpt4+P+yhvG8:1dYH7BBfQBi+l5QzkPJ
• TLSH: T19D3ED04534B69264E8BA44FAF49C483E6BC709754002DDBDA54F090632D17D7CBAC36E
• Submitted as: virussign.com_603162643308fdd6cd71c7b144233780.vir
• File type: pe · Size: 148992 bytes
• Verdict: malicious (100/100) · Family: PolyRansom

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): BC.Win.Virus.Ransom-9157.A
• Microsoft Defender: Virus:Win32/Nabucur.A
• Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
• Trellix Stinger (McAfee): W32/VirRansom
• Kaspersky (KVRT): Virus.Win32.PolyRansom.a

Why this verdict

The malicious score of 100/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 7 finding(s), e.g. RWX/private injected region in vcIYEIkQ.exe (pid 856) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.4 (rule Win32.Virlock.Gen.4) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 16 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6647/files/5a71ec8e028d7e4b94f81d899c7a1f71f9d7435e35d407f43edc53c2b6f16992 - 5a71ec8e028d7e4b94f81d899c7a1f71f9d7435e35d407f43edc53c2b6f16992
• /opt/CAPEv2/storage/analyses/6647/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
• /opt/CAPEv2/storage/analyses/6647/files/eaf7802a6e13dbe9879d91e0aa1836d6173d71b7a2bfe0b418c8267e7b3b65be - eaf7802a6e13dbe9879d91e0aa1836d6173d71b7a2bfe0b418c8267e7b3b65be
• /opt/CAPEv2/storage/analyses/6647/files/ebe6c11a4360919f323bf4c1a5668f61edfa2a9ad9140b88ba3c9560867d01bf - ebe6c11a4360919f323bf4c1a5668f61edfa2a9ad9140b88ba3c9560867d01bf
• /opt/CAPEv2/storage/analyses/6647/files/4eca508beacbdf792a8e900aac74ad25448b9b6b0f2e90391aa3d99a35020dcb - 4eca508beacbdf792a8e900aac74ad25448b9b6b0f2e90391aa3d99a35020dcb
• /opt/CAPEv2/storage/analyses/6647/files/b9bdab467732ddd17dbed7e49e4b76da233e2f1db4186e0b72c864e7ee643e54 - b9bdab467732ddd17dbed7e49e4b76da233e2f1db4186e0b72c864e7ee643e54
• /opt/CAPEv2/storage/analyses/6647/files/f4f778782ed593bbc0a42d952b0bba46c8e235f16fd452769b3ab66d9ca9af68 - f4f778782ed593bbc0a42d952b0bba46c8e235f16fd452769b3ab66d9ca9af68
• /opt/CAPEv2/storage/analyses/6647/files/195995c9afc2669d73a1c60311c4ab1a0f126e80ff0699531027ca2ee33ef9cb - 195995c9afc2669d73a1c60311c4ab1a0f126e80ff0699531027ca2ee33ef9cb
• /opt/CAPEv2/storage/analyses/6647/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
• /opt/CAPEv2/storage/analyses/6647/files/fbcb4e124630e369a0fd3ad900d90cdc97677b3efdbfb4a00e330b5c8b581357 - fbcb4e124630e369a0fd3ad900d90cdc97677b3efdbfb4a00e330b5c8b581357
• /opt/CAPEv2/storage/analyses/6647/files/ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a - ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a
• /opt/CAPEv2/storage/analyses/6647/files/59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc - 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
• /opt/CAPEv2/storage/analyses/6647/files/4d15279582b8d34119710528f3fd1da028d87aa051bb4c3e35e62ccc131c7920 - 4d15279582b8d34119710528f3fd1da028d87aa051bb4c3e35e62ccc131c7920
• /opt/CAPEv2/storage/analyses/6647/files/721571e5fb8fca4a3baf4bf5be3e1d8a53cfaed24efd59735f13e4cc8611b04b - 721571e5fb8fca4a3baf4bf5be3e1d8a53cfaed24efd59735f13e4cc8611b04b
• 1cff43e3f1aa51d75d5aacd01ef2fce7e6bc35d44d62d8d51e9e50961ad56f8c - 1cff43e3f1aa51d75d5aacd01ef2fce7e6bc35d44d62d8d51e9e50961ad56f8c

Embedded domains

• t.no

More PolyRansom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report