MALICIOUS — virussign.com_5b8438493c8234def4b7c52d362be9e0.vir

MALICIOUS — virussign.com_5b8438493c8234def4b7c52d362be9e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Guap family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 705576e371131780cca9d2fbc48b35bcc169bb97cb6fb2ef3ebbb8aabc181736
• SHA-1: cd7f42d4294a4cda2955257db42b884b32259809
• MD5: 5b8438493c8234def4b7c52d362be9e0
• imphash: b6230692891661869cecd581561a21f4
• ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXg:zW6ncoyqOp6IsTl/mXg
• TLSH: T15A4CBEC8BAC7DD54E8E97B86E45544BDD68BD12F186D2E8F0392C2386F812F3A471112
• Submitted as: virussign.com_5b8438493c8234def4b7c52d362be9e0.vir
• File type: pe · Size: 533228 bytes
• Verdict: malicious (94/100) · Family: Guap

Source: VirusSign · first seen 2026-08-15T00:00:00.000Z · SHA-256 verified

Detections (6 of 55 engines)

• ClamAV (daily): Win.Worm.Guap-4
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Microsoft Defender: Trojan:Win32/Fsysna!pz
• Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1
• Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• server.com
• tsymantec.com
• tsecurityresponse.symantec.com
• tsarc.com
• twww.sarc.com
• twww.sophos.com
• tsophos.com
• twww.mcafee.com
• tmcafee.com
• tliveupdate.symantecliveupdate.com
• twww.viruslist.com
• tviruslist.com
• tf-secure.com
• twww.f-secure.com
• tf-prot.com
• twww.f-prot.com
• tkaspersky.com
• tkaspersky-labs.com
• twww.avp.com
• tavp.com
• twww.kaspersky.com
• twww.networkassociates.com
• tnetworkassociates.com
• twww.ca.com
• tca.com

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• C:\Program
• C:\WINDOWS\system32\drivers\etc\hosts

More Guap samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report