MALICIOUS — virussign.com_db3145c85f6e87d2346d445c5986b710.vir

MALICIOUS — virussign.com_db3145c85f6e87d2346d445c5986b710.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Salgorea family. 3 of 51 detection engines flagged it.

Identification

• SHA-256: 2f63b5bf05cd4b9f2cda071df4156bba708f762a8e48e7150c97318c01dd6ab5
• SHA-1: c7ab747c76b0f657c15819970132d3b169745841
• MD5: db3145c85f6e87d2346d445c5986b710
• imphash: ce4fd09cd7cd5e270b8b4f6800de501f
• ssdeep: 12288:NU5rCOTeij/Vfenb5b8ihtakckAAGkkV0OEZxLKQaU0FTZwlH:NUQOJjdfeb5b8gurAGkM0OEfKQoTSlH
• TLSH: T1DF4CE1949284A785DA73DB6038D54E0D50E3B4EB207D298C87C3F02E27F9E5FB0561A9
• Submitted as: virussign.com_db3145c85f6e87d2346d445c5986b710.vir
• File type: pe · Size: 517632 bytes
• Verdict: malicious (96/100) · Family: Salgorea

Source: VirusSign · first seen 2026-07-28T00:00:00.000Z · SHA-256 verified

Detections (3 of 51 engines)

• ClamAV (daily): Win.Packed.Zpack-10001780-0
• Microsoft Defender: TrojanDownloader:Win32/Upatre
• Kaspersky (KVRT): HEUR:Backdoor.Win32.Salgorea.gen

Why this verdict

The malicious score of 96/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Packed.Zpack-10001780-0 (rule Win.Packed.Zpack-10001780-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:Win32/Upatre (rule TrojanDownloader:Win32/Upatre) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Salgorea.gen (rule HEUR:Backdoor.Win32.Salgorea.gen) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.oracle.com/education/oln
• http://metalink.oracle.com
• http://oracle.com/contracts

Embedded domains

• schemas.microsoft.com
• www.oracle.com
• metalink.oracle.com
• oracle.com
• microsoft.com

File paths

• D:\:p:

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report