MALICIOUS — virussign.com_c778da0845c7f56a3d47ae98d40035e0.vir

MALICIOUS — virussign.com_c778da0845c7f56a3d47ae98d40035e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the HUILoader family. 4 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 42620127f73ca4c23f85f3df82dde969f0dffc82da953299c6ebbb22f14e7cc2
• SHA-1: 6e33bb4c487cbb3360b6170264fb4d731b8cccfe
• MD5: c778da0845c7f56a3d47ae98d40035e0
• imphash: febaee8927c610d77250f9573b8ca76d
• ssdeep: 98304:7VG21W4E02i3X9BaTpO9OQFScMMf+Fvgc5RzvWW7IUqvS5:l2OzaaFSQcreBRK5
• TLSH: T1D0689D9E011B3161D1F9DE14B830C5DD90A3F498A534A9CE8603DA6781AAE67FBF00F5
• Submitted as: virussign.com_c778da0845c7f56a3d47ae98d40035e0.vir
• File type: pe · Size: 7527472 bytes
• Verdict: malicious (82/100) · Family: HUILoader

Source: VirusSign · first seen 2026-08-09T00:00:00.000Z · SHA-256 verified

Detections (4 of 52 engines)

• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Trellix/McAfee ATR: ATR_LockBit_Ransomware
• YARA: ReversingLabs: RL_Formbook_XLoader
• YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

• T1547.001
• T1071.001
• T1057

Why this verdict

The malicious score of 82/100 is the fusion of 8 weighted signals:

• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_LockBit_Ransomware (rule ATR_LockBit_Ransomware) - engine signal, weight 0.35, confidence 0.70
• YARA: ReversingLabs flagged RL_Formbook_XLoader (rule RL_Formbook_XLoader) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: https://pulsebrowser.com, https://cdn.pulsesupdate.com/icons/, http://www.years - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://pulsebrowser.com
• https://m.google.com/devicemanagement/data/api
• https://cdn.pulsesupdate.com/icons/
• http://www.years
• http://.jpg
• http://www.interpretation
• https://www.recent
• http://www.wencodeURIComponent
• http://www.icon
• http://www.hortcut
• http://www.w3.org/shortcut
• http://.css
• http://www.css
• http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
• https://sectigo.com/CPS0
• http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#

Embedded domains

• openssl.org
• activity.cc
• installer.cc
• service.cc
• prefs.cc
• pulsebrowser.com
• uninstall.cc
• field.cc
• time.cc
• util.cc
• tag.cc
• pulsesupdate.com
• m.google.com
• cdn.pulsesupdate.com
• blink.net
• wmi.cc
• values.cc
• thread.cc
• mem.cc
• cbb.cc
• utils.cc
• gurl.cc
• settings.cc
• puffpatch.cc
• zip.cc

File paths

• a:\(
• W:\J

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report