MALICIOUS — virussign.com_12f45d5d301ae8bc3dec183b28c3a110.vir

MALICIOUS — virussign.com_12f45d5d301ae8bc3dec183b28c3a110.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the NabucurObfs family. 5 of 51 detection engines flagged it.

Identification

• SHA-256: 5c75043bdce304dcf4d83ed7afa435c7bac2c255ee0fe623e9b23b1beeba5555
• SHA-1: 9308fc91da130c49602e295cadb5df3ca7cc778f
• MD5: 12f45d5d301ae8bc3dec183b28c3a110
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 24576:4daKcyyjWip688SBxy20451ZGt82HFjCxOhjZln3wy64:eaKJlW6L2045TZG
• TLSH: T1A95875F8CED0136140DFC6AABDEA694A5B9734273A647A0C23172D536074CC1786CBA7
• Submitted as: virussign.com_12f45d5d301ae8bc3dec183b28c3a110.vir
• File type: pe · Size: 1663488 bytes
• Verdict: malicious (98/100) · Family: NabucurObfs

Source: VirusSign · first seen 2026-07-28T00:00:00.000Z · SHA-256 verified

Detections (5 of 51 engines)

• ClamAV (daily): BC.Win.Virus.Ransom-9157.B
• Microsoft Defender: Trojan:Win32/NabucurObfs
• Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
• Trellix Stinger (McAfee): W32/VirRansom
• Kaspersky (KVRT): Virus.Win32.PolyRansom.a

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.B (rule BC.Win.Virus.Ransom-9157.B) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

File paths

• r:\-

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report