SUSPICIOUS — virussign.com_d9f9a698efd8793f9de778825721eef0.vir

SUSPICIOUS — virussign.com_d9f9a698efd8793f9de778825721eef0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (46/100). 1 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 53f726f1d5d7ada0e142f5e65c517062039140b5fb3a3f117d79f34ec0edd2bb
SHA-1: 9a724e37dfd7ddf5ccd95a105d29f9c8212811cb
MD5: d9f9a698efd8793f9de778825721eef0
imphash: b8f7d0e0f83de4cae7f7fece4a2f750e
ssdeep: 49152:TeQ7nWBO4+L16gqkpkk4v3Hda7osRUAp3+UikWfqgjnP1Fy4X68:6LBOjMUq043
TLSH: T1B3618CA201133115D8F0BD50B430C88DA49FF858D5354FED8257FA6B92DAAAFA3E04E5
Submitted as: virussign.com_d9f9a698efd8793f9de778825721eef0.vir
File type: pe · Size: 3940864 bytes
Verdict: suspicious (46/100)

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (1 of 55 engines)

Emsisoft (Emergency Kit): Gen:Variant.Rugmi.Lazy.1

MITRE ATT&CK

T1497

Why this verdict

The suspicious score of 46/100 is the fusion of 2 weighted signals:

Contacted 28 external host(s) at runtime (30 HTTP) - network signal, weight 0.40, confidence 0.80
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

94 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782555&P2=404&P3=2&P4=BeLFTn0VKIWzCn5FzNhOO56W9yjbf%2bLPTQjzyA0dyhOzgUer%2bN9c2E%2f4q81vpOu6kMyfYbFh2pOGfvBSG%2bnXPw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782634&P2=404&P3=2&P4=RFcRsYiDlz2y6BxBJrBRLFPkMi6EDiwD1QUE0WH9cNOBEmYq5CoqpPUmKBTKzfHcq4%2brprRQ4Y8UWtgcAA0DTw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787179362&P2=404&P3=2&P4=dr1%2bSC%2bqf%2buI5CvbgmcHEL00rBJnxfPXeIRwoB%2fZmN%2fnYoF%2fQTRkpk70ET3GW88LE7Cas9dxTi3UOVXCkCWFtQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787178861&P2=404&P3=2&P4=n1gHJwEN2kPYz7Xm6qY%2feKiu9RAv%2f0nrv5dOxpZF%2fOzr8SXi%2f%2bdd5mskSK4a68hE%2fQ%2fzVyOWRL7Gc5bggqk8iQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.168.117.168
4.230.171.124
4.144.132.114
57.155.101.212
74.178.240.61
4.150.223.111
74.179.77.164
85.210.196.11
20.236.44.162
52.123.129.14
4.150.223.105
203.26.79.13
74.179.71.159
172.66.2.5
52.110.12.55
172.178.240.161
52.110.12.19
20.184.175.7
20.42.73.30
52.123.252.224
52.148.114.188
72.145.35.99
48.199.12.1
51.116.246.106
142.250.195.163

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report