MALICIOUS — virussign.com_5ef58f714eb547a62251c2a70e4bc6e0.vir

MALICIOUS — virussign.com_5ef58f714eb547a62251c2a70e4bc6e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Fareit family. 5 of 55 detection engines flagged it.

Identification

SHA-256: 3cc27bab0cd1c51a25761386836491374c2087c19b6e96bafe647d455ae4e90b
SHA-1: 29b90cf3a7c7ebfe81572780849e4226f28924ad
MD5: 5ef58f714eb547a62251c2a70e4bc6e0
imphash: cdad71f00be06ad1b130e995c45f78b1
ssdeep: 3072:u4Q/oYZ1TXi8Un7/lPaE6afhakwWKxhaCmH4OUzIByLXbytnYrlZ:u4UoubUnZPH6afi7TgByj2tnY
TLSH: T1FE4BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C685ABF17F7B98C5E1
Submitted as: virussign.com_5ef58f714eb547a62251c2a70e4bc6e0.vir
File type: pe · Size: 479241 bytes
Verdict: malicious (96/100) · Family: Fareit

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Trellix Stinger (McAfee): Trojan-JBCL!5EF58F714EB5
Kaspersky (KVRT): Trojan.Win32.VB.dosq

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 25 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

16884 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/Resou
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787935708&P2=404&P3=2&P4=MDqmbptCy82IAeJy2XlwvYuxI71N8k1B6w7f16DzMnUawA%2bel3bmZqpGkKFURtVF18pjqNIC3uMpcfSLPMMY%2fQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787935783&P2=404&P3=2&P4=EgBFOim0SLwJJfMAIK9x84iX1ZfJWx1NC2gxbm%2fZ042WeyYBc%2bqewis99QOrJZxDIuhdzV9TvK5d8i%2fls%2fz1pw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

52.123.252.223
13.89.179.12
52.123.252.240
40.84.85.40
4.230.171.124
52.253.84.76
135.233.95.144
4.150.223.112
74.178.240.51
40.103.64.242
20.112.250.133
52.123.128.14
52.123.252.213
4.150.223.108
52.168.117.171
52.123.252.227
135.233.45.222
203.26.79.13
20.165.94.46
52.148.114.188
48.211.4.16
20.42.179.192
72.154.7.108
52.110.12.8
52.110.12.4

File paths

C:\Program

More Fareit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report