MALICIOUS — virussign.com_81110be1a32d25848bb120d0bec63a30.vir

MALICIOUS — virussign.com_81110be1a32d25848bb120d0bec63a30.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Finfish family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 704f4129981f9360e937213d9da4e536afb515475644e636da70b3ba038dd3a8
• SHA-1: 138304e24d28c9e35395dbf2232521f2204e8dda
• MD5: 81110be1a32d25848bb120d0bec63a30
• imphash: 95122753ea27818b35f9b51859e4c692
• ssdeep: 98304:emhd1Uryew/wDB1SFpOm6LV7wQqZUha5jtSyZIUb:elQ/Ca02QbaZtli
• TLSH: T19269D0DD9804BB08EEAE7A1705A9D7EE39B174D13430AC8C0741C532B18D6736F395AA
• Submitted as: virussign.com_81110be1a32d25848bb120d0bec63a30.vir
• File type: pe · Size: 8218624 bytes
• Verdict: malicious (93/100) · Family: Finfish

Source: VirusSign · first seen 2026-08-07T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• capa (capabilities): capability:execution/powershell
• ClamAV (daily): Win.Trojan.Finfish-9787043-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Salgorea!pz
• Emsisoft (Emergency Kit): Trojan.Agent.GIKJ
• Kaspersky (KVRT): Trojan.Win32.Agent.gen

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 93/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Finfish-9787043-0 (rule Win.Trojan.Finfish-9787043-0) - engine signal, weight 0.90, confidence 0.95
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://schemas.microsoft.com/winfx/2006/xaml
• http://schemas.microsoft.com/xps/2005/06
• http://schemas.microsoft.com/xps/2005/06/resourcedictionary-key
• http://schemas.microsoft.com/xps/2005/06/documentstructure+System.Windows.Documents.DocumentStructures
• http://schemas.microsoft.com/windows/annotations/2003/11/coreT
• http://schemas.microsoft.com/winfx/2006/xaml/presentation/options
• http://go.microsoft.com/fwlink?LinkID=119805
• http://www.w3.org/2001/XMLSchema
• http://tempuri.org/XMLSchema.xsd
• http://www.w3.org/XML/1998/namespace
• http://schemas.microsoft.com/xps/2005/06/documentstructure
• http://schemas.microsoft.com/winfx/2006/xaml/presentation
• http://schemas.openxmlformats.org/package/2006/relationships/metadata/thumbnail
• http://schemas.microsoft.com/xps/2005/06/restricted-font
• http://schemas.microsoft.com/xps/2005/06/discard-control
• http://microsoft.com/
• http://support.microsoft.com/kb/954494
• http://go.microsoft.com/fwlink?prd=11953&sbp=Bootwinfx&pver=
• http://www.w3.org/2000/xmlns/
• http://schemas.microsoft.com/xps/2005/06/storyfragments
• http://schemas.microsoft.com/xps/2005/06/printticket
• http://schemas.microsoft.com/wpf/2005/10/xaml/component
• http://schemas.microsoft.com/windows/annotations/2003/11/core

Embedded domains

• schemas.microsoft.com
• go.microsoft.com
• www.w3.org
• tempuri.org
• schemas.openxmlformats.org
• microsoft.com
• support.microsoft.com

Registry keys

• HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Windows

File paths

• I:\hizh
• f:\dd\wpf\src\windows.snk

More Finfish samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report