MALICIOUS — virussign.com_d10695f8baf68e63d1a72afc34f91000.vir

MALICIOUS — virussign.com_d10695f8baf68e63d1a72afc34f91000.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the HUILoader family. 9 of 51 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 2a0d0488b52f6b28c5adbc91d80d31d0a75a2118aaffa758ea28fd465372df65
• SHA-1: d92129cf314bab85cb4786ac5b2d1ac5449fc28d
• MD5: d10695f8baf68e63d1a72afc34f91000
• imphash: 3d6ced804674199f8cfcd96853d64303
• ssdeep: 49152:/4A+w1GH+zNsGRFpYiUan8Rb281FL6n+M7UxRQO5J6uqQW8v10eyGx4wFBYwyIN:vrzXpkF0J99JI+GW45jxvdz4uzBGMo
• TLSH: T1BC686C9B012B2212D2E5EF04B53184DED073F4A4A5346CDF8146DA268099E6FBFB43B5
• Submitted as: virussign.com_d10695f8baf68e63d1a72afc34f91000.vir
• File type: pe · Size: 8085504 bytes
• Verdict: malicious (94/100) · Family: HUILoader

Source: VirusSign · first seen 2026-08-03T00:00:00.000Z · SHA-256 verified

Detections (9 of 51 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:collection/keylog
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Virus:Win32/Expiro.CCCF!MTB
• Emsisoft (Emergency Kit): Win64.Expiro.Gen.6
• Kaspersky (KVRT): Virus.Win64.Expiro.f

MITRE ATT&CK

• T1547.001
• T1071.001
• T1057
• T1056.001
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 94/100 is the fusion of 10 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: https://perfetto.dev/docs/contributing/getting-started#community, https://crashpad.chromium.org/, https://crashpad.chromium.org/bug/new - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://perfetto.dev/docs/contributing/getting-started#community
• https://clients2.google.com/cr/report
• https://crashpad.chromium.org/
• https://crashpad.chromium.org/bug/new
• http://www.w3.org/2001/XMLSchema-instance
• https://support.google.com/chrome/?p=usage_stats_crash_reports
• https://support.google.com/chrome?p=chrome_uninstall_survey

Embedded domains

• openssl.org
• uninstall.cc
• m.google.com
• mutex.cc
• field.cc
• time.cc
• utils.cc
• rds.descriptor.name
• descriptor.name
• perfetto.dev
• regex.cc
• allocator.cc
• executor.cc
• parser.cc
• clients2.google.com
• crashpad.chromium.org
• blink.net
• install.cc
• www.w3.org
• values.cc
• thread.cc
• sequence.cc
• histogram.cc
• gurl.cc
• mem.cc

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report