MALICIOUS — virussign.com_2ee6bd2c38c95a29e895bf3839205bc0.vir

MALICIOUS — virussign.com_2ee6bd2c38c95a29e895bf3839205bc0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Swisyn family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 583d0b06e49fb7a084c8f4b9f3aa7bfde21059370921b8802179339b98d9b614
• SHA-1: 447411d50d2549a25064c29a7b4456f884f58a9f
• MD5: 2ee6bd2c38c95a29e895bf3839205bc0
• imphash: 920c5b87a46ecabb54af798a017ac6a1
• ssdeep: 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unBLHp:5vEN2U+T6i5LirrllHy4HUcMQY64Lp
• TLSH: T13D421BD9CD5A5F66DD22CD03D08C0D5D505AF97893E4E19C670384E6A3E4AEB88AC03B
• Submitted as: virussign.com_2ee6bd2c38c95a29e895bf3839205bc0.vir
• File type: pe · Size: 211839 bytes
• Verdict: malicious (94/100) · Family: Swisyn

Source: VirusSign · first seen 2026-08-15T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Malware.Swisyn-7610494-0
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• Microsoft Defender: Trojan:Win32/Swisyn!pz
• Emsisoft (Emergency Kit): Trojan.VB
• Trellix Stinger (McAfee): Swisyn.aq!2EE6BD2C38C9
• Kaspersky (KVRT): Trojan.Win32.Swisyn.bner

MITRE ATT&CK

• T1071.001
• T1057
• T1056.001

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Malware.Swisyn-7610494-0 (rule Win.Malware.Swisyn-7610494-0) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/cdo/configuration/

Embedded domains

• schemas.microsoft.com

File paths

• C:\Program
• C:\WINDOWS\system32\ieframe.dll

More Swisyn samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report