MALICIOUS — virussign.com_303d06ebda1c6fd4997d0f2c248fe2e0.vir

MALICIOUS — virussign.com_303d06ebda1c6fd4997d0f2c248fe2e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Dinwod family. 11 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 533e2877f16ae5cb4ca4a19c69ed0de69ed247e4b50c8343f6b6a63d32e2c026
SHA-1: 483b53cce8dbc0985dbb9b0038f40efda0984612
MD5: 303d06ebda1c6fd4997d0f2c248fe2e0
imphash: 7b0dae1a789cef762977aaeada455b93
ssdeep: 6144:Wcm4FmowdHoS+JsJlJeJPJoJEJhJ9JQJpJgJXJJJXJ2JXJWJXJZJXJ2JXJUJFJXC:44wFHoSzZ2g1
TLSH: T186627273F4121EC6DB49B336844AB4EE467235BB08D8E1844617E6857DD4FA33AB620C
Submitted as: virussign.com_303d06ebda1c6fd4997d0f2c248fe2e0.vir
File type: pe · Size: 4239971 bytes
Verdict: malicious (100/100) · Family: Dinwod

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (11 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Dinwod-9828955-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Backdoor:MSIL/Bladabindi!pz
Emsisoft (Emergency Kit): Trojan.Agent.EZHO
Trellix Stinger (McAfee): Trojan-FPCQ!D13584937FB3
Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Malware.Dinwod-9828955-0 (rule Win.Malware.Dinwod-9828955-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Backdoor:MSIL/Bladabindi!pz (rule Backdoor:MSIL/Bladabindi!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.EZHO (rule Trojan.Agent.EZHO) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FPCQ!D13584937FB3 (rule Trojan-FPCQ!D13584937FB3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Dropper.Win32.Dinwod.acqn (rule Trojan-Dropper.Win32.Dinwod.acqn) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:.data1 - static signal, weight 0.25, confidence 0.55
Dropped 16 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

634 behavior events · 0 ATT&CK techniques · 17 dropped files.

Dropped files

C:\nxdbfvj.exe - 890ab7dc5709168cf34db55586591db6242ba2cee35beea5622379b2b812a703
C:\pjdthh.exe - 9b4c397502d29eaf17ecc67f81ea7e446d538d8340fba5cdb095c0504095c762
C:\lbjnrl.exe - 6d4cbd1c8402d7b4230387e7184024aa904f9cca2ce92ec81a5ff73313f6ba49
C:\fxhfftp.exe - eddd67cffa5e0511b2a8ac682b79e19e30aaed894215df390d8da36b30e98672
C:\hrxjp.exe - a0e5b1ddf5a43232719ca9ab7bcf21aa33295d1de1673a1df02cfc438a096152
C:\ddjhxx.exe - 8a392b498615bcf30f22ead605d26f28d0a7cd5c1f60ff91a439ed47fb46dda1
C:\ljxhrh.exe - 7d7111c3c6affa7b6851e99986dd070f5d5c92372bf2bd256989ae9726511677
C:\htxdv.exe - 0ef61c8f4df78d2821f5dbe2a2f7f8e417dee7171d8a6116b60983e452965795
C:\vhhpd.exe - 9cfb91eed5cedb4de984e5c6a99148918bb061d3004a6c527cf60323d18f95f0
C:\djtnvvr.exe - 9fbb190fefc1a65539f830469b654151452d4566931536e741ec07853f8a94fd
C:\rnvxltn.exe - 470466c61410bb89d90033ed28bed459ee57bed75e910d1f376cdebb16f0bb98
C:\xhxjbt.exe - 89efd23242d8338c5f642f3427c8d674b245c87cac2f6e0462ba1d9d2928ba88
C:\dtfphd.exe - 16de95ae208d52ef007796010ab57b7b8982d6b04a3c230ae7611c1ad089b0ee
C:\fndrjf.exe - e58be08fccf0fd8295c61ec61eeccb592b78bd9644363389c2a6d4a8c468c61e
C:\bttnr.exe - 02dbae01ad03c135e01d402b0149636ea35388656e9b61673c310efac6516d7c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

40.79.141.155
52.230.59.222
4.230.171.124
135.232.92.97
85.210.196.11
20.165.94.63
172.64.154.167
20.42.73.24
51.116.253.168
52.148.114.188
57.155.101.212
72.145.35.110
52.110.12.22
52.110.12.55

More Dinwod samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report