MALICIOUS — virussign.com_ede39fc5d7991ba691cc58da09180c70.vir

MALICIOUS — virussign.com_ede39fc5d7991ba691cc58da09180c70.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the Maldoc family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 425a9612282fc938d8c4e9469d24990d67305ca7e1c996217c36a8e6e55263bf
SHA-1: d8615e6fbcc686f23edfe59b5080f55bd544d2a2
MD5: ede39fc5d7991ba691cc58da09180c70
imphash: d058de892eb271cb836fb7509a04426e
ssdeep: 6144:dQF69d2HgFmRxLxCc2P5LynxkNAkYaSaM2NDhXmw1SYaDYXpEX1UnEv/P1UGv+3e:j2SpSYnEv2GvWxIs9OZbYPKjji36Ix4
TLSH: T1494E5AC0D887A58BC3A9D608D4E198DC483DF0A4F4B1C1A81652E199ADFDD3371BB64B
Submitted as: virussign.com_ede39fc5d7991ba691cc58da09180c70.vir
File type: pe · Size: 650149 bytes
Verdict: malicious (82/100) · Family: Maldoc

Source: VirusSign · first seen 2026-08-17T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:credential-access
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!EDE39FC5D799
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 82/100 is the fusion of 8 weighted signals:

access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

d334405b7d0d99563544e81498aa481df2743794a5bd8be499a1ded58ee195e0 - d334405b7d0d99563544e81498aa481df2743794a5bd8be499a1ded58ee195e0

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787652452&P2=404&P3=2&P4=gN10Ge5tnQfTsYFHS60V2Rd6BJgwvCnClsfIKUSKoMb%2bcHQo3R7sxlBoMVoXmrFJKNYAx5VYMBiVcAK%2bsycWZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

20.184.175.13
52.123.252.238
52.123.252.240
172.215.188.225
4.230.171.124
20.247.184.142
20.247.185.124
20.165.94.63
135.232.92.97
20.165.94.46
20.184.175.14
85.210.193.152
203.26.79.13
20.231.239.246
52.123.128.14
40.99.134.2
52.123.129.14
172.178.240.162
92.223.78.30
52.148.114.188
72.154.7.108
135.233.95.80
52.110.12.19
52.110.12.54

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report