SUSPICIOUS — virussign.com_b5951d8180961de104dc9eda31414410.vir

SUSPICIOUS — virussign.com_b5951d8180961de104dc9eda31414410.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (48/100). 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 26867a177a1a6669a060be921bc08f0cb9e4b5c413ef375a02f4b105049f7545
SHA-1: 627fca44e1f2a41a5232d0f6de628f86ab37b13a
MD5: b5951d8180961de104dc9eda31414410
imphash: eab2822f4f6021dc561a130b059b61e2
ssdeep: 1536:/26TrxpeBAmp/YtsDzFP2+ri9BaPdwtjc2B55eJpdtT3://rx0npwtsDzFPDrytY2XY
TLSH: T1E63502C40C345A6ED0A9A7342704F5DCBF104BDF91189C784C484059699ACABABAAFD3
Submitted as: virussign.com_b5951d8180961de104dc9eda31414410.vir
File type: pe · Size: 60416 bytes
Verdict: suspicious (48/100)

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (4 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
Microsoft Defender: Trojan:Win32/Copak.GPAC!MTB
Emsisoft (Emergency Kit): Trojan.Peed.Gen
Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.vho

MITRE ATT&CK

T1105

Why this verdict

The suspicious score of 48/100 is the fusion of 3 weighted signals:

Contacted 28 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

107 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tsk_d942cfc1b90845c3.exe - 903696663c126ae443b690eb8e4fec56e96d39fa941f57a5acbfa160eacc9585
684648cc5d343a326e3c9e3b21ee28c80180b68dae08474a6363a86342324db8 - 684648cc5d343a326e3c9e3b21ee28c80180b68dae08474a6363a86342324db8
2cde0acab3f045d8e29b16879257e31d6923d5b75e3245c2516220f966992b62 - 2cde0acab3f045d8e29b16879257e31d6923d5b75e3245c2516220f966992b62
4eabcdc2c6629987c43a6eff729594659ab0f2fdcd4857b260fd028b79e1b9f4 - 4eabcdc2c6629987c43a6eff729594659ab0f2fdcd4857b260fd028b79e1b9f4
bfeb6afa3056a5a59f95a5fe0f4bfdf71e8c052bf2ffeb0792d3d1d2321c0b89 - bfeb6afa3056a5a59f95a5fe0f4bfdf71e8c052bf2ffeb0792d3d1d2321c0b89

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787729115&P2=404&P3=2&P4=apidavlYJE7KLrQVgRtbA80LtZziVM%2fW6AJI1BIZaiQ9CdF8AUjFxXsE5UrrP5X5atBCoX1mS4urt%2feiTZ%2fnlw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787729183&P2=404&P3=2&P4=Hy19c7gPTigTTv4ogbEnnoW0351ThixgN3LSkSY5fj0O%2fu4lYKowBz819Wl4QR1d%2fNA00PExG78qZ3nG6Pa1lw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

48.211.4.16
85.210.196.11
203.26.79.13
52.123.129.14
40.79.150.122
57.155.101.212
4.230.171.124
20.247.184.142
52.253.84.76
135.232.92.34
20.184.175.14
74.178.76.128
135.233.95.135
135.232.92.137
52.123.128.14
20.112.250.133
40.99.134.18
135.234.160.246
92.223.78.30
52.123.252.197
74.178.232.29
52.148.114.188
52.110.12.4
52.110.12.37
40.84.85.40

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report