MALICIOUS — virussign.com_3e119bcca2192f86216b988ef0b6d880.vir

MALICIOUS — virussign.com_3e119bcca2192f86216b988ef0b6d880.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Guap family. 6 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 68fdb76f277daf64a61e26eef6c3f5482ba37048e3676e82fda5385b653b7adb
• SHA-1: bf80855e1169973a70af41024ee915e1276f516d
• MD5: 3e119bcca2192f86216b988ef0b6d880
• imphash: b6230692891661869cecd581561a21f4
• ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXR:zW6ncoyqOp6IsTl/mXR
• TLSH: T1684CBEC87AC7DD54E8E97B86E45554BDD68BD12F182D2E8F0392C2386F812F3A471112
• Submitted as: virussign.com_3e119bcca2192f86216b988ef0b6d880.vir
• File type: pe · Size: 533393 bytes
• Verdict: malicious (94/100) · Family: Guap

Source: VirusSign · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (6 of 51 engines)

• ClamAV (daily): Win.Worm.Guap-4
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Microsoft Defender: Trojan:Win32/Fsysna!pz
• Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
• Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• server.com
• tsymantec.com
• tsecurityresponse.symantec.com
• tsarc.com
• twww.sarc.com
• twww.sophos.com
• tsophos.com
• twww.mcafee.com
• tmcafee.com
• tliveupdate.symantecliveupdate.com
• twww.viruslist.com
• tviruslist.com
• tf-secure.com
• twww.f-secure.com
• tf-prot.com
• twww.f-prot.com
• tkaspersky.com
• tkaspersky-labs.com
• twww.avp.com
• tavp.com
• twww.kaspersky.com
• twww.networkassociates.com
• tnetworkassociates.com
• twww.ca.com
• tca.com

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• C:\Program
• C:\WINDOWS\system32\drivers\etc\hosts

More Guap samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report