MALICIOUS — virussign.com_7188fa9a04acf74700597a53bfc79020.vir

MALICIOUS — virussign.com_7188fa9a04acf74700597a53bfc79020.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the DangerousObject family. 5 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 607b6c89258874c24420f3aed493f6ef213af2ab859ac8cdac590265ffa5ed08
SHA-1: 4154ead82e8628858d94dbfd28ed2b3a5b800af5
MD5: 7188fa9a04acf74700597a53bfc79020
imphash: e780223af31e5cc3f52e2ebb06482260
ssdeep: 6144:A//ICMmDpsYwvPsD1Q/MLMp1o4UHrC26zPC3pCd3LnUmh4n9Wvo6o1GHY:A//kY6PC1QLLoFe2WPGpCd3Lv4n9WvoL
TLSH: T12E47022A13943EDEF1230EA1C76C5F5F502B90B9B6B20745A642C71CBAD44779B312B2
Submitted as: virussign.com_7188fa9a04acf74700597a53bfc79020.vir
File type: pe · Size: 331377 bytes
Verdict: malicious (99/100) · Family: DangerousObject

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

ClamAV (daily): Win.Malware.Pvpk-10056926-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Worm:Win32/Sfone!pz
Emsisoft (Emergency Kit): Generic.Malware.PfVPk!!prn!.FE0B916D
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Pvpk-10056926-0 (rule Win.Malware.Pvpk-10056926-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

106072 behavior events · 2 ATT&CK techniques · 9 dropped files.

Dropped files

C:\$WinREAgent\Scratch\WimTempPath\beast mtu2oyuh5 d2jspkm3 sweet .mpeg.exe - 14c86f53071548e7993e1672b28a7b23925bd9a9181dcfcf4f81e0f117b65edd
C:\Program Files\LibreOffice\share\basic\Template\l8qccpyq beast [milf] .avi.exe - 441c2b04ac38ce3d3091dc504322a6b339366b7217b2631a14489d4a586258e9
C:\Program Files\LibreOffice\share\6mw7u7 4mvc8yaot jmmawhs [milf] .rar.exe - 71af66724af259cef96810e21ef2e599e6817be161ecca941e7a2449fee1f8f7
C:\PPLFaultTemp\asian xxx [free] n12wc0jz71 .rar.exe - 4507230a0b3f8886be623e102a1e36124ed9d346a2f34a93828c61ce38ce8b2a
C:\Program Files\Common Files\microsoft shared\xiwlzi0 4mvc8yaot [free] (Liz,Jenna).zip.exe - 2859858679050411bb37c9460e782d0ab4fc3f18491ef0af98ff52a3935dffb0
C:\Program Files\LibreOffice\share\template\ko6o6a kmozxo latex (5qcarib).mpeg.exe - 158b455806d2cfb414cf53b556d19dc63e40a83c93a72ecac33465368c21fd90
C:\Program Files\LibreOffice\share\extensions\wiki-publisher\templates\bwpt7j 9k8bf2i [milf] ttbp10m (Karin).mpg.exe - 7bad4579a2f604e64b4c7cb1d5f049f7cd767a2663f106bde49456cc7ee5b454
C:\Program Files\Windows Sidebar\Shared Gadgets\wluwp0ne 4fq06c uncut boobs skl4wbo .avi.exe - 414d7eb9ef99c36103a49d9090935f63bf345dee99c67ca874988f76f21d4a53
C:\WINDOWS6g2yf6t03h - 9ceb5575be5c35aab3353a005d9c1462f16fa1d3415d482f0e0615742cbef953

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787935863&P2=404&P3=2&P4=H1skJMWAHSFOLN58PQC25jwFyKo4LBQf4t0uUgMPgsgv5Ii%2fJU9IZ5N3A1T6nVhnO2vty5ugCSijr99UsbIu3A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787935927&P2=404&P3=2&P4=LUofHVfFl8KMZO5J9VJJwMEHG5OpIfcP9A7bnU4YwwSebRnpmvecFDXPyTkocPs41IFclYUEdP2sEL4T1OKfVA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.168.117.174
20.42.179.204
4.230.171.124
20.247.185.124
20.165.94.63
74.179.77.164
20.42.65.89
74.179.77.204
20.112.250.133
52.123.129.14
20.184.175.9
203.26.79.13
172.178.240.161
135.232.92.34
52.148.114.188
172.178.240.162
52.123.252.241
72.154.7.109
92.223.78.30
52.110.12.19
52.110.12.51

More DangerousObject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report