MALICIOUS — virussign.com_e91bc6100bfaa0b93e07b1be3a4d37e0.vir

MALICIOUS — virussign.com_e91bc6100bfaa0b93e07b1be3a4d37e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Muldrop family. 4 of 55 detection engines flagged it.

Identification

SHA-256: 5de501f9f250a0eda334fed52ec168f425b798ebdc0e3fbe8dea97993b7e93fc
SHA-1: 2f4abbf7a8b93358373ebf9ce7b943d89641052f
MD5: e91bc6100bfaa0b93e07b1be3a4d37e0
imphash: b7b1d154ca47a083b83fddc13f54b733
ssdeep: 3072:6c+y5Ao5xRU33t61FXmhYy8t/3vMYviuN:6c2oit61MYrt/3EYviu
TLSH: T15F418FAF309249BFC30A63847BD018CC17E353DA21575CAAE148DA99D9B53FBAD90071
Submitted as: virussign.com_e91bc6100bfaa0b93e07b1be3a4d37e0.vir
File type: pe · Size: 188471 bytes
Verdict: malicious (96/100) · Family: Muldrop

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Midie-6847893-0
Microsoft Defender: TrojanDropper:Win32/Muldrop.V!MTB
Emsisoft (Emergency Kit): Gen:Heur.Conjar.9
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.pef

Why this verdict

The malicious score of 96/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Midie-6847893-0 (rule Win.Malware.Midie-6847893-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

19820 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sTy
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850384&P2=404&P3=2&P4=BBOFLsCnC7FcHE4PtyJWZqkR%2b8NAYOt0HDMe5a%2ff06uDXFqROwxRH5FENFXMfBCP%2fPWc8Vat7%2fAST3tAaJF%2b8A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850496&P2=404&P3=2&P4=evYubX4qUS6HYWbu8n6LaErfRyD0diAbXkp6s%2f6x1udkilLJNynPA%2bdcW%2bR%2fHOrHQJ6h2B91BMk7oNWxUQfK1A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

52.168.117.170
57.154.63.210
4.230.171.124
52.230.60.54
135.233.95.144
74.178.76.54
4.207.44.70
52.123.129.14
20.231.239.246
52.123.128.14
40.103.64.226
135.234.160.246
203.26.79.13
52.148.114.188
52.123.252.236
52.123.252.234
20.165.94.46
20.42.179.204
20.42.73.28
51.116.246.104
172.178.240.163
72.145.35.109
52.110.12.11
52.110.12.10

File paths

C:\Program

More Muldrop samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report