SUSPICIOUS — virussign.com_f0cd9075e08ba3d0f497b27d767c2030.vir
SUSPICIOUS — virussign.com_f0cd9075e08ba3d0f497b27d767c2030.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (52/100). 0 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
236c50263c145bb85a57493c1834ae91b476991a3570c798b3aa4e639baf3189 - SHA-1:
f077e5d092d655d1ba66564d48df67fc3502e457 - MD5:
f0cd9075e08ba3d0f497b27d767c2030 - imphash:
8c9b2976eaea0b9a2279ef415ba03ab1 - ssdeep:
3072:oCinL9JNxIP5FS6XLfdN850pEknvIt/xwILqxCs3w4LfSy:oCM9qRFS6XLrRvQxwIqxC03p - TLSH:
T11B416B6610033061D5B5FE98F510CCEDC823B4526631858DC61FE90EB2B9EB7A7B24E9 - Submitted as: virussign.com_f0cd9075e08ba3d0f497b27d767c2030.vir
- File type: pe · Size: 195640 bytes
- Verdict: suspicious (52/100)
Source: VirusSign · first seen 2026-08-15T00:00:00.000Z · SHA-256 verified
Detections (0 of 52 engines)
No engine flagged this sample.
MITRE ATT&CK
Why this verdict
The suspicious score of 52/100 is the fusion of 3 weighted signals:
- Contacted 13 external host(s) at runtime (12 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://repository.certum.pl/ccsca2021.cer0, https://www.certum.pl/CPS0, http://repository.certum.pl/ctnca2.cer09 - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
18 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
Embedded URLs
- http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
- http://repository.certum.pl/ccsca2021.cer0
- https://www.certum.pl/CPS0
- http://crl.certum.pl/ctnca2.crl0l
- http://repository.certum.pl/ctnca2.cer09
- http://www.certum.pl/CPS0
- http://subca.repository.certum.pl/ctsca2021.cer0
- http://subca.crl.certum.pl/ctsca2021.crl0
- http://crl.certum.pl/ctnca.crl0k
- http://repository.certum.pl/ctnca.cer09
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- index.crates.io
- ccsca2021.crl.certum.pl
- repository.certum.pl
- www.certum.pl
- crl.certum.pl
- subca.repository.certum.pl
- subca.crl.certum.pl
Embedded IP addresses
- 20.184.175.21
- 40.84.85.40
- 4.230.171.124
- 20.247.184.197
- 135.233.95.144
- 20.50.201.203
- 135.234.160.246
- 4.150.223.106
- 52.148.114.188
- 20.231.239.246
- 184.84.165.171
- 52.110.12.31
- 52.110.12.2
File paths
- C:\Users\RedEye\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\de.rs
- C:\Users\RedEye\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\value\ser.rs
- C:\Users\RedEye\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\collections\btree\navigate.rs
- C:\Users\RedEye\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\read.rs
- C:\Users\RedEye\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\error.rs
- C:\Users\RedEye\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs
- C:\Users\RedEye\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\collections\btree\map\entry.rs
- C:\Users\RedEye\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\collections\btree\node.rs
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report