MALICIOUS — virussign.com_2f1be30f883818d98cfe566b1bb75b80.vir

MALICIOUS — virussign.com_2f1be30f883818d98cfe566b1bb75b80.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Vilsel family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 334ad96cd9613d8d6acddee0d3f402730454f821c71479899786e7915abae1cf
• SHA-1: 64c2406ee7d6ed56b419e24e46bcee263f625bc7
• MD5: 2f1be30f883818d98cfe566b1bb75b80
• imphash: 5b6800968ce46864bea452e918bdcc08
• ssdeep: 6144:163+NDdL0yqu5uPBhLRjpML0KYj3NAilJ0FcmjU4:Y+HAJ3PBh9jkK3NAi/0FceH
• TLSH: T1974D3BD7892A1E10F1BA145886AE8F6ED25AB3FC1D983EAE1D03C43E945AD07C417F11
• Submitted as: virussign.com_2f1be30f883818d98cfe566b1bb75b80.vir
• File type: pe · Size: 567380 bytes
• Verdict: malicious (99/100) · Family: Vilsel

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Genpack-6989317-0
• Microsoft Defender: Trojan:Win32/Vilsel!pz
• Emsisoft (Emergency Kit): Worm.VB.UB
• Trellix Stinger (McAfee): Trojan-FHNB!A3F0C1E4E30F
• Kaspersky (KVRT): Trojan.Win32.Vilsel.bpxe

MITRE ATT&CK

• T1486

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Malware.Genpack-6989317-0 (rule Win.Malware.Genpack-6989317-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Vilsel!pz (rule Trojan:Win32/Vilsel!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Worm.VB.UB (rule Worm.VB.UB) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FHNB!A3F0C1E4E30F (rule Trojan-FHNB!A3F0C1E4E30F) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.Vilsel.bpxe (rule Trojan.Win32.Vilsel.bpxe) - engine signal, weight 0.55, confidence 0.85
• Packing/obfuscation: UPX, high-entropy-sections:camzt - static signal, weight 0.25, confidence 0.55
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

File paths

• d:\w7rtm\ds\netapi\svcdlls\logonsrv\idl\netpdc.c
• d:\w7rtm\ds\netapi\svcdlls\logonsrv\server\nlcrypto.c

More Vilsel samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report