MALICIOUS — virussign.com_b9bfb067be2fc235ff5abeaae58ad3c0.vir

MALICIOUS — virussign.com_b9bfb067be2fc235ff5abeaae58ad3c0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Maldoc family. 9 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 3062516feeb2867ce7ed59f6208be5f40281d8e8924e16e135ab7f6745719140
• SHA-1: 4afe75160a0e16fd0aef9dfcc4837427d55d9566
• MD5: b9bfb067be2fc235ff5abeaae58ad3c0
• imphash: 77eb68348ee30e01ec09fce3582c5f76
• ssdeep: 12288:JsjCF2QZiOU+4zX7wM45QygROD22O3ZGdZK:JOC39Uv7V4WnROD22cqK
• TLSH: T1894DD011418A3391DBF2DD61A17DB62EC05B3188D0FB0FC8AA57D43E17E6A1349362E6
• Submitted as: virussign.com_b9bfb067be2fc235ff5abeaae58ad3c0.vir
• File type: pe · Size: 589824 bytes
• Verdict: malicious (98/100) · Family: Maldoc

Source: VirusSign · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (9 of 51 engines)

• capa (capabilities): capability:execution/powershell
• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.1
• ClamAV (daily): Win.Packed.Generic-9795615-0
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• LIEF (executable format parser): lief:invalid-authenticode
• Microsoft Defender: Trojan:Win32/LummaStealer.ZD!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Adware.Babar.22375
• Kaspersky (KVRT): Backdoor.Win32.Shiz.dzg

MITRE ATT&CK

• T1059.001
• T1056.001

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Win.Packed.Generic-9795615-0 (rule Win.Packed.Generic-9795615-0) - engine signal, weight 0.90, confidence 0.95
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1 - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:.1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://crl.verisign.com/tss-ca.crl0
• https://www.verisign.com/rpa
• https://www.verisign.com/rpa01
• http://crl.verisign.com/pca3.crl0
• http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D
• https://www.verisign.com/rpa0
• https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
• https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

Embedded domains

• j.nl
• crl.verisign.com
• www.verisign.com
• docs.google.com
• www.dropbox.com
• oogle.co
• csc3-2004-crl.verisign.com

Registry keys

• HKCU\Software\Microsoft\Office\

File paths

• C:\Wind
• C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL
• C:\Program
• C:\Windows\SysWOW64\stdole2.tlb
• C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL#Visual
• C:\Windows\SysWOW64\stdole2.tlb#OLE

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report