SUSPICIOUS — virussign.com_919c60abdf769cc819e1b85f13b84710.vir
SUSPICIOUS — virussign.com_919c60abdf769cc819e1b85f13b84710.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (53/100). 2 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
282470a9a0d8dd50a401068f89085d9c9c3e935f9774ddc6f4d5d2c1197e385e - SHA-1:
3b82edf8c16a6103c3e3485cc370c40475ad8197 - MD5:
919c60abdf769cc819e1b85f13b84710 - imphash:
2f940dc89fb799c29f5c6a50ca2eeaca - ssdeep:
12288:DZX8CbMSt6QY3gn0WvEPeIPIgipnHHY+dVowPs7v:DZX8CbMSt6l3g04gIgipnnY+dVOv - TLSH:
T18E4E8D45C142791BFDF2D844E874499CD092B0F8A63AAD9A531FF86C61FDDB780E04A8 - Submitted as: virussign.com_919c60abdf769cc819e1b85f13b84710.vir
- File type: pe · Size: 625845 bytes
- Verdict: suspicious (53/100)
Source: VirusSign · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (2 of 51 engines)
- capa (capabilities): capability:collection/keylog
- Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen
MITRE ATT&CK
Why this verdict
The suspicious score of 53/100 is the fusion of 4 weighted signals:
- capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Embedded network infrastructure: https://workink.net/21oH/jgzd3bmf, https://helpware.sellhub.cx/product/helpware-triggerbot/, https://helpware.lol - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://workink.net/21oH/jgzd3bmf
- https://helpware.sellhub.cx/product/helpware-triggerbot/
- https://helpware.lol
- https://workink-sdk-distribution.workink.click/workink-windows-key-system-sdk/WorkInkKeySystem_x64.dll
- https://api.ipify.org
- https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage
- https://work.ink/_api/v2/token/isValid/
Embedded domains
- workink.net
- discord.gg
- api.ipify.org
- github.com
- helpware.sellhub.cx
- helpware.lol
- workink-sdk-distribution.workink.click
- work.ink
File paths
- C:\Windows\Fonts\segoeui.ttf
- C:\Users\Sweety\Desktop\ALLIN\hwfreetb\hwfreetb\hwfreetb\hwfreetb\x64\Release\hwfreetb.pdb
- C:\Users\yousm\Desktop\Velocity
- p:\Qk
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report