MALICIOUS — virussign.com_2ad0029da9d2630b42953941fd3e7310.vir

MALICIOUS — virussign.com_2ad0029da9d2630b42953941fd3e7310.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Reactor family. 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 69450717a20e6506715fa9d61d4ca76a4f5e2e411e4ed7122eccd0bbbaa0657a
SHA-1: 45482dd2deea84c01f8a2e0413f2fdd446ed3249
MD5: 2ad0029da9d2630b42953941fd3e7310
imphash: 88016fcdef7f227c62171d0afad9aae4
ssdeep: 49152:uuI2h0919WRHcTeynRkfg7ve+AhrWzOUN:u5O0919WR8zaQe+UrEOUN
TLSH: T1BF5AAE9A7F1B7622C769D7201060BA7F08F3AC4F07BF5A4801A5AB1E96F441715E138B
Submitted as: virussign.com_2ad0029da9d2630b42953941fd3e7310.vir
File type: pe · Size: 2132080 bytes
Verdict: malicious (92/100) · Family: Reactor

Source: VirusSign · first seen 2026-07-18T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): .NET Reactor 2.X-3.X
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:.NET Reactor 2.X-3.X
Microsoft Defender: flagged
Kaspersky (KVRT): not-a-virus:HEUR:Downloader.Win32.Softonic.gen

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 92/100 is the fusion of 8 weighted signals:

Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7600) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:.NET Reactor 2.X-3.X (rule DIE:.NET Reactor 2.X-3.X) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline, 4.0.2.0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: .NET Reactor 2.X-3.X - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6274 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3646/files/3a62ae0d102cff66fba0a1f0b9bcdf116ad369c3c4f0212eb21a53c766c75a7d - 3a62ae0d102cff66fba0a1f0b9bcdf116ad369c3c4f0212eb21a53c766c75a7d
65af4fd8219e2a6babcf06dc393f6108045626dec9755ea67ae4726062986ec6 - 65af4fd8219e2a6babcf06dc393f6108045626dec9755ea67ae4726062986ec6
e43b5c863f7a27542d5f1d3715ccc5436f187b5809fd127d2fa7389f0dedcaa2 - e43b5c863f7a27542d5f1d3715ccc5436f187b5809fd127d2fa7389f0dedcaa2

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
https://sectigo.com/CPS0
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
https://jrsoftware.org/ishelp/index.php?topic=setupcmdline

Embedded domains

schemas.microsoft.com
crl.comodoca.com
cacerts.digicert.com
crl3.digicert.com
crl.sectigo.com
crt.sectigo.com
sectigo.com
jrsoftware.org
www.msftconnecttest.com
searchapp.bundleassets.example
dns.msftncsi.com
config.edge.skype.com
ctldl.windowsupdate.com
watson.events.data.microsoft.com
aps.prod.windows.com
ecs.office.com
g.live.com
fs.microsoft.com
www.msftncsi.com
self.events.data.microsoft.com
msedge.api.cdp.microsoft.com
www.bing.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com
edge.microsoft.com

Embedded IP addresses

4.0.2.0

File paths

T:\:d:l:p:t:x:
X:\:`:d:h:l:p:t:x:
N:\:k:
E:\:
X:\:`:h:p:x:
U:\:c:j:t:
T:\:j:x:
X:\:d:h:p:t:x:
T:\:d:l:t:
D:\Coding\Is\issrc-build\Components\ChaCha20.pas
x:\dirname

More Reactor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report