MALICIOUS — virussign.com_530bded18b9c67b01f8256d891b53d00.vir

MALICIOUS — virussign.com_530bded18b9c67b01f8256d891b53d00.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Obfus family. 5 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 21e8a0de26d3cbf9af16ff34433b653c13a5d94f74df6e596f7ec79b8f8b227f
SHA-1: 693b7ba5bcdd4ffdbc6d5fba262b2ea57bb1d59b
MD5: 530bded18b9c67b01f8256d891b53d00
imphash: 3f31a7866f74667f87832eb6a3bec06d
ssdeep: 1536:C+S5b0UZYoruFG8Ke8jEQC7JaufLSFBb1cgCe8uC:o5bZ2jYmfuBbugCe8uC
TLSH: T17A365CE2C2F30231CEE2825666F6BBBCD1F40597227140A2D0C6E4617866857F5E53ED
Submitted as: virussign.com_530bded18b9c67b01f8256d891b53d00.vir
File type: pe · Size: 68620 bytes
Verdict: malicious (91/100) · Family: Obfus

Source: VirusSign · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (5 of 51 engines)

ClamAV (daily): Win.Trojan.Obfus-38
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Backdoor:Win32/Berbew!pz
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.C639BED9
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh

MITRE ATT&CK

T1071.001

Why this verdict

The malicious score of 91/100 is the fusion of 3 weighted signals:

ClamAV (daily) flagged Win.Trojan.Obfus-38 (rule Win.Trojan.Obfus-38) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

howtotell.com
microsoft.com

More Obfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report