MALICIOUS — virussign.com_394f14ff3f674a2524b133006d7939d0.vir
MALICIOUS — virussign.com_394f14ff3f674a2524b133006d7939d0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
469996be4252bb8cb0824a2774d7881bd29b61c3215efb236f57ea4159ec3ceb - SHA-1:
8a16156666c08c48d067a640e384614b45fe1b86 - MD5:
394f14ff3f674a2524b133006d7939d0 - imphash:
26babd76bbb7f9c516a338b0601b4c9f - ssdeep:
1536:39Qh5I1fB2TAaEqTmftreHELivWwqxv8+2ixVSXAuCX+xQR:39Q32fB9qWeH/6xvuyVrX+2R - TLSH:
T13A397C644A2519B4FE1F14E214CEAEFF221C29EA0CE166F039C6526B42ED997700D357 - Submitted as: virussign.com_394f14ff3f674a2524b133006d7939d0.vir
- File type: pe · Size: 91525 bytes
- Verdict: malicious (99/100) · Family: Crypted
Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified
Detections (4 of 56 engines)
- ClamAV (daily): Win.Trojan.Crypted-30
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Trojan.Peed.Gen
- Kaspersky (KVRT): Backdoor.Win32.Padodor.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule
Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged flagged (rule
flagged) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Peed.Gen (rule
Trojan.Peed.Gen) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Backdoor.Win32.Padodor.gen (rule
Backdoor.Win32.Padodor.gen) - engine signal, weight 0.55, confidence 0.85 - Contacted 3 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Dropped 46 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
1475 behavior events · 1 ATT&CK techniques · 46 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- th.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
- slscr.update.microsoft.com
Dropped files
- C:\Windows\System32\Emiekfbi.exe -
6edae50ff84af90b524129a1afa41a931923900746d51095e0eba3736debf348 - C:\Windows\System32\Mkpodi32.exe -
d094c2722b88f24046270f05e5865c7908aa00e170ec68a37c061ed01be273bf - C:\Windows\System32\Kkbqcede.dll -
80cd51b1942ea3e5ecd5d9504d74b47c040d16bd20707850dbda846d1c067780 - C:\Windows\System32\Mmgofgjb.dll -
c262ab582c758968f900c47444b8168cbe18b4fa6e0566615d4c74628e606ef2 - C:\Windows\System32\Lfgfehbc.dll -
be357aae626f2d61cfae681a784e8f6f8f84348529a6a010f8bb86a7f48bb4ba - C:\Windows\System32\Flnfoa32.dll -
12a085e4c7e1d15e9c352d5b700a7fa06723c575e2becb5787ccf2efbf9e6eb9 - C:\Windows\System32\Flheba32.exe -
ad351c917f9fd59e15049c945a0d3190de031e6de5d1c1ca098668544ae835c0 - C:\Windows\System32\Kbpohpmh.exe -
a28e57af580e3732447bab054fc79a98a32faebdd4e1a7db2ce3bacb3d5ba4c7 - C:\Windows\System32\Aojica32.exe -
ead284ca299b7496bddefc9fe4e6066d2d77d78fff8bf5492469aae4b3078d3f - C:\Windows\System32\Jhqpihdm.dll -
18bb87882ed945cef2665a10d24e775a32256a5f909494379bf2a213f88567bf - C:\Windows\System32\Inmmeoen.exe -
1b56e27fee2ffc85d3ec5fb82ce845f71ea194c132e4c97bd70fa7384d89e2e9 - C:\Windows\System32\Abbada32.dll -
b002bf07e5e0eb01a865860a6a30807b9d2bf0f8dcbc8a394775cd165bc09382 - C:\Windows\System32\Egfcokdd.exe -
2acc30cb93a01d5c404906e54bf359d5acb35c5907a6746ebf59b6684535bc90 - C:\Windows\System32\Ggnbgh32.exe -
cbf62adc47b4fa27030f992a59d048c091746508b68bb78ec9656a6bfa1dd80b - C:\Windows\System32\Ngabqoeh.dll -
dca81872245b7c3601ee0e96e2685e0cc7290609d122125a9635173d6e3cc96f
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788282389&P2=404&P3=2&P4=HslyE1GcfMbMg6MyZoIjBk6eXe6ulq%2fg84rgk1PWnCfex1x5%2bdtL1ggZrUO4GaFxp5f0Ie8w%2bPRnEacaeYL3Ig%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.184.175.21
- 52.123.252.243
- 20.247.184.197
- 4.230.171.124
- 104.18.33.89
- 74.178.76.54
- 52.168.117.169
- 74.178.240.61
- 40.84.85.40
- 172.178.240.161
- 20.165.94.46
- 203.26.79.13
- 52.110.12.42
- 52.110.12.31
- 52.110.12.46
- 52.110.12.38
- 72.154.7.107
More Crypted samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report