MALICIOUS — virussign.com_1c27ccb60b1d8df715282e190ba61a10.vir

MALICIOUS — virussign.com_1c27ccb60b1d8df715282e190ba61a10.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the HUILoader family. 10 of 51 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 5e3493e8ed6953ff60528c730078412a012eb32b2e395cbd7a87b5771070a603
• SHA-1: ce71d7a6bb971d1115832043e40fe4cd84e6d675
• MD5: 1c27ccb60b1d8df715282e190ba61a10
• imphash: 4d1b1bc01b4916a680bf17fc1cfd1058
• ssdeep: 49152:HlsKd6Tv4Xs1TOt3XAL8Njmbb/Hedc+KokvY0n/sHQ4VD//IOSArTpYDOJj40Nsd:S2iH3/Hed+UsiC96UDl
• TLSH: T1D0626CDE012B3266D1E9DD14B831C5DCC0A7F4E8A538998E8603DA67806AD57BEF00F5
• Submitted as: virussign.com_1c27ccb60b1d8df715282e190ba61a10.vir
• File type: pe · Size: 4477645 bytes
• Verdict: malicious (94/100) · Family: HUILoader

Source: VirusSign · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (10 of 51 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:collection/keylog
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
• Trellix Stinger (McAfee): Trojan-JARZ!1C27CCB60B1D
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1547.001
• T1071.001
• T1057
• T1056.001
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 94/100 is the fusion of 10 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: https://crashpad.chromium.org/, https://crashpad.chromium.org/bug/new - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://crashpad.chromium.org/
• https://crashpad.chromium.org/bug/new
• http://www.w3.org/2001/XMLSchema-instance
• https://clients2.google.com/cr/report
• https://support.google.com/chrome/?p=usage_stats_crash_reports
• http://www.digicert.com/CPS0
• https://support.google.com/chrome?p=chrome_uninstall_survey

Embedded domains

• openssl.org
• uninstall.cc
• field.cc
• time.cc
• crashpad.chromium.org
• streams.cc
• install.cc
• www.w3.org
• blink.net
• values.cc
• logging.cc
• check.cc
• gurl.cc
• clients2.google.com
• settings.cc
• wmi.cc
• thread.cc
• shortcut.cc
• arena.cc
• sequence.cc
• support.google.com
• cacerts.digicert.com
• crl3.digicert.com
• www.digicert.com
• crl4.digicert.com

File paths

• C:\b\s\w\ir\cache\builder\src\out\Release_x64\setup.exe.pdb

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report