MALICIOUS — virussign.com_8963072e53fecea192184d3f7973e5d0.vir
MALICIOUS — virussign.com_8963072e53fecea192184d3f7973e5d0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 5 of 55 detection engines flagged it.
Identification
- SHA-256:
635e0d1efec862bdb0e38e3d04aab099fa1fb1c3023672a3853f9bed999c1f48 - SHA-1:
6e8147ace7adf56958ebf2bd7219fbfcc4fff0d7 - MD5:
8963072e53fecea192184d3f7973e5d0 - imphash:
c2bd7cd7b6bc030f043da9448ba453a5 - ssdeep:
1536:heT7BVwxfvEFwjRs1PDXFi0VvBYv3kZtAV7ZBbP1yVGqV6zSVSGzsNE0zp:hmVwRKCULFlav+m7ZB5e3V6z1GzCZp - TLSH:
T184411B4053B55075C4EBC8E698E1CE3CE452105F747CDC7492E6C684ACF62BB982A2BB - Submitted as: virussign.com_8963072e53fecea192184d3f7973e5d0.vir
- File type: pe · Size: 187707 bytes
- Verdict: malicious (87/100)
Source: VirusSign · first seen 2026-08-15T00:00:00.000Z · SHA-256 verified
Detections (5 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Genpack-6989317-0
- Microsoft Defender: Trojan:Win32/PlugX!pz
- Emsisoft (Emergency Kit): Trojan.GenericKDZ.119016
- Kaspersky (KVRT): Trojan.Win32.Vilsel.loy
Why this verdict
The malicious score of 87/100 is the fusion of 2 weighted signals:
- ClamAV (daily) flagged Win.Malware.Genpack-6989317-0 (rule
Win.Malware.Genpack-6989317-0) - engine signal, weight 0.90, confidence 0.95 - Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://oracle.com/contracts
- http://www.oracle.com/education/oln
Embedded domains
- microsoft.com
- go.microsoft.com
- adr.org
- oracle.com
- www.oracle.com
- support.microsoft.com
- howtotell.com
- o15.officeredir.microsoft.com
File paths
- C:\Program
- C:\WINDOWS\system32\msvbvm60.dll\3
- C:\Documents
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report