MALICIOUS — virussign.com_dac69402f572fceba196eff349fadc10.vir

MALICIOUS — virussign.com_dac69402f572fceba196eff349fadc10.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Fareit family. 5 of 55 detection engines flagged it.

Identification

SHA-256: 530ea74b180f32c3160669f217e784460daa3fb14b463eb16618cf996f099f50
SHA-1: 09d85b0e3ea63f10bd535447a3650043d2e6ca34
MD5: dac69402f572fceba196eff349fadc10
imphash: cdad71f00be06ad1b130e995c45f78b1
ssdeep: 3072:iBO0oYZ1TIkD8Un7/11b46afhEk0WgJhvq/HdpUb70UVX4Ap4uhlX:iBFoxkwUnJ1M6af+TkS0UJ5p4u
TLSH: T1D74BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C689A7F17F7B98C5E1
Submitted as: virussign.com_dac69402f572fceba196eff349fadc10.vir
File type: pe · Size: 479284 bytes
Verdict: malicious (96/100) · Family: Fareit

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Trellix Stinger (McAfee): Trojan-JBCL!DAC69402F572
Kaspersky (KVRT): Trojan.Win32.VB.dosq

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 22 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

20067 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/Resou
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850067&P2=404&P3=2&P4=deXmP216AP6O53k2vPzTVi7zPh8AM7dM4VArRRKaveuTYsZGHb6lyk9svxNMHNMh1nZHzwpRuTHDM27j9r%2fnYw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850098&P2=404&P3=2&P4=iUTFTi5VdQ1EjmN5%2bdz45MyG3ASpUwp%2b7Bg8Gbn2nx5tg0Poz28V3cktHZ%2bzyk7LEcsib0q2lCOqy7ZnAb5xUA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

4.207.44.77
4.230.171.124
52.253.84.76
172.215.188.232
74.179.77.204
135.232.92.97
20.184.175.7
20.231.239.246
52.123.128.14
52.123.129.14
135.233.45.222
203.26.79.13
92.223.78.30
52.123.252.204
20.165.94.46
40.84.85.40
52.148.114.188
135.233.45.223
135.234.160.246
72.154.7.113
52.110.12.45
52.110.12.4

File paths

C:\Program

More Fareit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report