MALICIOUS — virussign.com_c677a0d316a3da35225c67f0ae9c60b0.vir
MALICIOUS — virussign.com_c677a0d316a3da35225c67f0ae9c60b0.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the HTML family. 3 of 51 detection engines flagged it.
Identification
- SHA-256:
3bb2ff2905dba453b8439d0ef083c0ad96cceac822aecf08c9cb69e272b910e9 - SHA-1:
87cf1d6f219f66981bf48f733c3fa5fa1af0ff8c - MD5:
c677a0d316a3da35225c67f0ae9c60b0 - ssdeep:
192:aR8pKfsTxcYoHSiFnzA5GYJcaaeK2Ii6POJdt+K9eq+0llYe3mY8YoHsfOBro2Tx:aexcYoHSiFXi6GnomjQmQYoHsfO2/e - TLSH:
T18527D92FA7F42FCF8786259874FC711E2862ECDBA91150EAD59E6C498C4CC247C88974 - Submitted as: virussign.com_c677a0d316a3da35225c67f0ae9c60b0.vir
- File type: html · Size: 16322 bytes
- Verdict: malicious (90/100) · Family: HTML
Source: VirusSign · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified
Detections (3 of 51 engines)
- YARA: ReversingLabs: RL_Formbook_XLoader
- Microsoft Defender: Trojan:HTML/Redirector.MSS!MTB
- Emsisoft (Emergency Kit): Generic.HTML.Redirector.B.A7D827F8
Why this verdict
The malicious score of 90/100 is the fusion of 5 weighted signals:
- Microsoft Defender flagged Trojan:HTML/Redirector.MSS!MTB (rule
Trojan:HTML/Redirector.MSS!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Generic.HTML.Redirector.B.A7D827F8 (rule
Generic.HTML.Redirector.B.A7D827F8) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec, defense-evasion (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - YARA: ReversingLabs flagged RL_Formbook_XLoader (rule
RL_Formbook_XLoader) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://euob.northwavepoint.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.js, https://obseu.northwavepoint.com/ns/636f8b858f681acb7bfa6f583a96630a.html?ch=AdsDeli%20-%20iFrame, http://yfdpco4.com/sk-park.php?pid=9PO15V947&dn=getpdf.pw&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F128.0.0.0+Safari%2F537.36&requrl=http%3A%2F%2Fgetpdf.pw%2Fbook%3Fres%3Dvista%26isbn%3D9781603585101%26kwd%3DMarijuana%2520is%2520Safer%3A%2520So%2520Why%2520are%2520We%2520Driving%2520People%2520to%2520Drink%3F - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
- http://www.w3.org/1999/xhtml
- https://euob.northwavepoint.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.js
- https://obseu.northwavepoint.com/ns/636f8b858f681acb7bfa6f583a96630a.html?ch=AdsDeli%20-%20iFrame
- http://yfdpco4.com/sk-park.php?pid=9PO15V947&dn=getpdf.pw&ua=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F128.0.0.0+Safari%2F537.36&requrl=http%3A%2F%2Fgetpdf.pw%2Fbook%3Fres%3Dvista%26isbn%3D9781603585101%26kwd%3DMarijuana%2520is%2520Safer%3A%2520So%2520Why%2520are%2520We%2520Driving%2520People%2520to%2520Drink%3F
- https://www.mydomaincontact.com/?domain_name=getpdf.pw
Embedded domains
- www.w3.org
- getpdf.pw
- d38psrni17bvxu.cloudfront.net
- euob.northwavepoint.com
- obseu.northwavepoint.com
- yfdpco4.com
- www.mydomaincontact.com
- style.top
More HTML samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report