SUSPICIOUS — virussign.com_3d9193e81062a689866869dee021a550.vir
SUSPICIOUS — virussign.com_3d9193e81062a689866869dee021a550.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 0 of 54 detection engines flagged it.
Identification
- SHA-256:
5268f4909f587811c9ca3d6a9c5f1c0a2ba9a21ec5eec0910bd05e49ceedbf4f - SHA-1:
dd47153c111d0a8ceeecc3385222af16cbd6df3c - MD5:
3d9193e81062a689866869dee021a550 - ssdeep:
768:0ITZmXg8INXEvh2n4pqoofJ7kkIrTr5e6j2CrV:xTZmXZINXEvoNRkkIrTr5e6HV - TLSH:
T10F30F78B136A3CDFCB4A0513E59C546E40E2FBCFA2651AEC8315EB4ED865DE071084AD - Submitted as: virussign.com_3d9193e81062a689866869dee021a550.vir
- File type: html · Size: 38559 bytes
- Verdict: suspicious (54/100)
Source: VirusSign · first seen 2026-08-23T00:00:00.000Z · SHA-256 verified
Detections (0 of 54 engines)
No engine flagged this sample.
Why this verdict
The suspicious score of 54/100 is the fusion of 2 weighted signals:
- Obfuscated javascript script: dynamic-exec, defense-evasion (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://go.cpanel.net/ie11deprecation, https://api.mailsync.dev/lampunghosting/whmsync.php, https://go.cpanel.net/privacy - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
1 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- settings-win.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- th.bing.com
Embedded URLs
- https://go.cpanel.net/ie11deprecation
- https://api.mailsync.dev/lampunghosting/whmsync.php
- https://go.cpanel.net/privacy
- http://www.w3.org/2000/svg
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- go.cpanel.net
- myvar.name
- api.mailsync.dev
- www.w3.org
Embedded IP addresses
- 52.168.117.174
- 85.210.196.11
- 52.123.252.198
- 52.230.60.54
- 4.230.171.124
- 20.42.179.204
- 74.178.240.51
- 4.150.223.97
- 74.179.77.204
- 74.178.76.128
- 20.42.65.88
- 172.64.154.167
- 52.110.12.8
- 52.110.12.24
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report