MALICIOUS — virussign.com_dd02bb9e671c54d4616b905f9fe8a930.vir

MALICIOUS — virussign.com_dd02bb9e671c54d4616b905f9fe8a930.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Vilsel family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 5a2e550592442ca004777685635edc5af8ff6c45e673e71ddfa237c2f8fc2dd2
• SHA-1: 6e0232c84ab5d2f308003378cca7b1089de3ed3b
• MD5: dd02bb9e671c54d4616b905f9fe8a930
• imphash: 5b6800968ce46864bea452e918bdcc08
• ssdeep: 6144:163+NDdL0yqu5uPBhLRjpML0KYj3NAilJ0FcmjUj:Y+HAJ3PBh9jkK3NAi/0FceU
• TLSH: T1C24D3BD7892A1E10F1BA145886AE8F6ED25AB3FC1D983EAE1D03C43E945AD07C417F11
• Submitted as: virussign.com_dd02bb9e671c54d4616b905f9fe8a930.vir
• File type: pe · Size: 567290 bytes
• Verdict: malicious (99/100) · Family: Vilsel

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Genpack-6989317-0
• Microsoft Defender: Trojan:Win32/Vilsel!pz
• Emsisoft (Emergency Kit): Worm.VB.UB
• Trellix Stinger (McAfee): Trojan-FHNB!95E3C883BCF4
• Kaspersky (KVRT): Trojan.Win32.Vilsel.bpxe

MITRE ATT&CK

• T1486

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

• ClamAV (daily) flagged Win.Malware.Genpack-6989317-0 (rule Win.Malware.Genpack-6989317-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Vilsel!pz (rule Trojan:Win32/Vilsel!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Worm.VB.UB (rule Worm.VB.UB) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FHNB!95E3C883BCF4 (rule Trojan-FHNB!95E3C883BCF4) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.Vilsel.bpxe (rule Trojan.Win32.Vilsel.bpxe) - engine signal, weight 0.55, confidence 0.85
• Packing/obfuscation: UPX, high-entropy-sections:camzt - static signal, weight 0.25, confidence 0.55
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

File paths

• d:\w7rtm\ds\netapi\svcdlls\logonsrv\idl\netpdc.c
• d:\w7rtm\ds\netapi\svcdlls\logonsrv\server\nlcrypto.c

More Vilsel samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report