MALICIOUS — virussign.com_dc47baed67b2bdd195ce24238f4d8950.vir
MALICIOUS — virussign.com_dc47baed67b2bdd195ce24238f4d8950.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 6 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
4d337f1e24be36648db4540a2887e67a9795cdf0879d5b1dcab7495b5ea8327e - SHA-1:
3d0445072989470464fbd009de079ef671440c7a - MD5:
dc47baed67b2bdd195ce24238f4d8950 - imphash:
8554f3572adc9e2d9892673b477a09c7 - ssdeep:
1536:o138VyhdJAUwELUz4GSmFi1M9lZBHcblcxy4A3plrWsUtoeaT5EhaWN4Q0D60W5:d+dW4xGSmFi1ML8Sxy46lcdwWN4hQ5a - TLSH:
T1E03A0166EDB0139DC0B3A6F5B939E6FCCE8C098FB470953298E5C96748B1103B6145B4 - Submitted as: virussign.com_dc47baed67b2bdd195ce24238f4d8950.vir
- File type: pe · Size: 93184 bytes
- Verdict: malicious (93/100)
Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified
Detections (6 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Packed.Generickdz-10018234-0
- Microsoft Defender: Trojan:Win32/Copak.GPX!MTB
- Emsisoft (Emergency Kit): Trojan.GenericKDZ.104744
- Trellix Stinger (McAfee): Glupteba-FUBP!DC47BAED67B2
- Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.pef
MITRE ATT&CK
Why this verdict
The malicious score of 93/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Packed.Generickdz-10018234-0 (rule
Win.Packed.Generickdz-10018234-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 28 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
- Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
- Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
113 behavior events · 0 ATT&CK techniques · 6 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\tsk_8846fb5becd7440a.exe -
27a11994217ee9b681674dcd1fa243a45513437e246b0e5952f565c36b000a3f - c34eeb1cfafafd947460909b9eb5f2ec6d79a2155d7a462bd564b03a23399099 -
c34eeb1cfafafd947460909b9eb5f2ec6d79a2155d7a462bd564b03a23399099 - 959eb01656a11afad9b33004a44fb638e9ef54e4bc50a5e51e1e2759ea8d931a -
959eb01656a11afad9b33004a44fb638e9ef54e4bc50a5e51e1e2759ea8d931a - 8ec45d5693f9a28ae5517cf37a4f9904920c15ba9866091dc4aa575bebd06d37 -
8ec45d5693f9a28ae5517cf37a4f9904920c15ba9866091dc4aa575bebd06d37 - c245521c0775686e34671a62fc6283737e166b8748bdcf6985017ab66432ba30 -
c245521c0775686e34671a62fc6283737e166b8748bdcf6985017ab66432ba30 - dbe2ebe67caf5825ff4d2a3c18e6ab5d8aaa037fa9baf7f3cddff0ecfbc3518e -
dbe2ebe67caf5825ff4d2a3c18e6ab5d8aaa037fa9baf7f3cddff0ecfbc3518e
Embedded URLs
- http://oracle.com/contracts
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782581&P2=404&P3=2&P4=gTKZtbsV67u6YrTYC9IG%2b8vAup53gm7fdz1fu0e9gTjc%2bdNrSEvJBynVYevQ4VuWrIN9xYpPHqVH%2bKJMw8bG2A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782652&P2=404&P3=2&P4=E8xC9DDQd%2bZapvVDZaPSpneqCcKJ6YsNsPsurdhxrBKmQCLwH0jXcOzvxBpHD2qdz3P2MKJC%2bt%2fvZc%2fmRdzf2w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- microsoft.com
- oracle.com
Embedded IP addresses
- 20.42.179.192
- 4.150.223.111
- 52.123.252.219
- 4.230.171.124
- 20.42.179.204
- 52.253.84.76
- 4.144.132.114
- 74.178.240.61
- 74.179.77.164
- 20.42.73.30
- 20.231.239.246
- 40.99.134.2
- 52.123.128.14
- 52.123.129.14
- 40.99.134.18
- 4.150.223.107
- 135.234.160.246
- 172.66.2.5
- 203.26.79.13
- 52.148.114.188
- 52.123.252.225
- 74.179.71.159
- 104.46.162.229
- 20.42.73.25
- 52.123.252.212
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report