MALICIOUS — virussign.com_a47bcf4f0979e27869c61b2d0f986a60.vir

MALICIOUS — virussign.com_a47bcf4f0979e27869c61b2d0f986a60.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Virlock family. 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 2b5de969b5bc4246d4d5b10ba3c07563c2d05521a3981de5a4a6ce2908ae38ef
SHA-1: ee0a111def574bd0303b8e8a9f049e725a9a5060
MD5: a47bcf4f0979e27869c61b2d0f986a60
imphash: 7bc7200ba916331470284468b9c1cdee
ssdeep: 12288:UW+lpnN/zQVF0aOseH+3wucMpUDpnOS3qvXGl0YXddsYyt:V4pnZQVF0HseH+w7Dn/tdsV
TLSH: T1694C0112C1CE311AC951D161AE87B94EFA49D3638E196BFC05D5FDC4AC24BCB2E188C8
Submitted as: virussign.com_a47bcf4f0979e27869c61b2d0f986a60.vir
File type: pe · Size: 518144 bytes
Verdict: malicious (99/100) · Family: Virlock

Source: VirusSign · first seen 2026-07-25T00:00:00.000Z · SHA-256 verified

Detections (6 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Virus.Virlock-6804475-0
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.1
Kaspersky (KVRT): Virus.Win32.PolyRansom.b
Trellix Stinger (McAfee): W32/VirRansom.b

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Virus.Virlock-6804475-0 (rule Win.Virus.Virlock-6804475-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 7 finding(s), e.g. RWX/private injected region in powershell.exe (pid 2468) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.1 (rule Win32.Virlock.Gen.1) - engine signal, weight 0.55, confidence 0.85
Extracted VirLock config (0 C2) - engine signal, weight 0.45, confidence 0.60
Extracted VirLock config (0 C2) - engine signal, weight 0.45, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

251 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3087/files/505f5d7b4b7db9dea911356fec46c4aec3dc32b3d662f99f91bdb28ef2300362 - 505f5d7b4b7db9dea911356fec46c4aec3dc32b3d662f99f91bdb28ef2300362
/opt/CAPEv2/storage/analyses/3087/files/3af499f4671779ecc2f3cb45d63435f171cd2e08c27ce5c316280632475f115b - 3af499f4671779ecc2f3cb45d63435f171cd2e08c27ce5c316280632475f115b
a2350e29a548a91234c16501fe1a6558bb3db7b96921f8c723f8c29c44348bdd - a2350e29a548a91234c16501fe1a6558bb3db7b96921f8c723f8c29c44348bdd

Embedded domains

www.msftconnecttest.com
searchapp.bundleassets.example
dns.msftncsi.com
config.edge.skype.com
www.bing.com
watson.events.data.microsoft.com
aps.prod.windows.com
msedge.api.cdp.microsoft.com

More Virlock samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report