MALICIOUS — virussign.com_20b7a04f2cd27e3096c4c697e3f3ecb0.vir

MALICIOUS — virussign.com_20b7a04f2cd27e3096c4c697e3f3ecb0.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the GenericFCA family. 2 of 50 detection engines flagged it.

Identification

• SHA-256: 3541b65800b952792e052c5aaf64a852c510faa2cac44b9b85ae780f8f6568cb
• SHA-1: a140197dd08a1f62d405b487e042ff406889582c
• MD5: 20b7a04f2cd27e3096c4c697e3f3ecb0
• ssdeep: 96:290uchWy78ElqWgq6+KYPK1TK6IulxHG7spSX4leEzelwvv5vpAQ9nmK/p5rtut+:2HchWy79lgq6gKlvx33xyu
• TLSH: T12D1E113447733ECFC7A71116EBA1A8AE928928DF815046F24785AF0FE944C30BD55E06
• Submitted as: virussign.com_20b7a04f2cd27e3096c4c697e3f3ecb0.vir
• File type: html · Size: 6968 bytes
• Verdict: malicious (87/100) · Family: GenericFCA

Source: VirusSign · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:HTML/ScrInject.SMW!MTB
• Emsisoft (Emergency Kit): Trojan.GenericFCA.Script.38097

Why this verdict

The malicious score of 87/100 is the fusion of 4 weighted signals:

• Microsoft Defender flagged Trojan:HTML/ScrInject.SMW!MTB (rule Trojan:HTML/ScrInject.SMW!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericFCA.Script.38097 (rule Trojan.GenericFCA.Script.38097) - engine signal, weight 0.55, confidence 0.85
• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://allyouneedis88.online:443/landings/wlc62/img/favicon.png, https://svntrk.com/assets/rbl107_6a69e0a4d5e82.js, https://allyouneedis88.online:443/click?s1=rbl107&s2=&s3=1013v53en&s4=&s5=&src=3pc&l=&v=dating&r=1&lbid= - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://allyouneedis88.online:443/landings/wlc62/img/favicon.png
• https://svntrk.com/assets/rbl107_6a69e0a4d5e82.js
• https://allyouneedis88.online:443/click?s1=rbl107&s2=&s3=1013v53en&s4=&s5=&src=3pc&l=&v=dating&r=1&lbid=
• https://allyouneedis88.online:443/landings/wlc62/fonts/vendor.css?id=ac1cdbbf72c5886ef9fa2c287818ed4f
• https://allyouneedis88.online:443/scripts/fp.v3.js?id=646d4b3deea4287def3fdfc18906bcc7
• https://allyouneedis88.online:443/landings/wlc62/js/vendor.js?id=f23bc11d2441d5b9e86b53d88a5908ea
• https://allyouneedis88.online:443/landings/wlc62/img/1.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/2.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/3.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/4.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/5.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/6.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/7.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/8.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/9.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/10.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/11.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/12.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/13.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/14.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/15.jpg
• https://allyouneedis88.online:443/landings/wlc62/img/16.jpg
• https://allyouneedis88.online:443?s1=rbl107&amp
• http://allyouneedis88.online/?s1=rbl107
• https://allyouneedis88.online:443/landings/wlc62/img/silhuette-1.svg

Embedded domains

• allyouneedis88.online
• svntrk.com

More GenericFCA samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report