MALICIOUS — virussign.com_fe10eb08ef87efbbee72858c3dad85f0.vir
MALICIOUS — virussign.com_fe10eb08ef87efbbee72858c3dad85f0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Ajku family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
717eda9a402919f0a1271d10f57619372b37105b5e23da0999952f6d6f897909 - SHA-1:
9b7bb54ca4890a07aaae4ada3160dbce024e7ca5 - MD5:
fe10eb08ef87efbbee72858c3dad85f0 - imphash:
cdad71f00be06ad1b130e995c45f78b1 - ssdeep:
3072:kICyoUQCBoXOlxWD1IN2vDlbUmQoKOzHXOC7HdDH872x0fnQ9kbGyC1:kIvoGeOl01u2vDlB3dHx0/4kbG - TLSH:
T1084BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C689A7F17F7B98C5E1 - Submitted as: virussign.com_fe10eb08ef87efbbee72858c3dad85f0.vir
- File type: pe · Size: 479286 bytes
- Verdict: malicious (94/100) · Family: Ajku
Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified
Detections (5 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Dropper.Ajku-10014126-0
- Microsoft Defender: Trojan:Win32/Fareit.VB!MTB
- Trellix Stinger (McAfee): Trojan-JBCL!FE10EB08EF87
- Kaspersky (KVRT): Trojan.Win32.VB.dosq
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Ajku-10014126-0 (rule
Win.Dropper.Ajku-10014126-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 31 external host(s) at runtime (29 HTTP) - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
- Dropped 19 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
7315 behavior events · 0 ATT&CK techniques · 19 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\Unicorn-62206.exe -
128b6d3f15d6d11a7f4465c28d06d773dd9ee1756f1183cf40416f7310bdac7b - C:\Users\analyst\AppData\Local\Temp\Unicorn-14733.exe -
7aa3a87da6d4492b4d47e07c119684e59dc2f0e46a07e04bbf49ce08d05def0e - C:\Users\analyst\AppData\Local\Temp\Unicorn-12372.exe -
caa4f81b9cd85d4224e72d7cedf8d2bc7c13068a7ec77b40229c67c65971fd1b - C:\Users\analyst\AppData\Local\Temp\Unicorn-29358.exe -
941973afb8e71cf86da11d183d86877e93229450fb48362d41a486caddcc4cc1 - C:\Users\analyst\AppData\Local\Temp\Unicorn-16145.exe -
3da65114e152a06c046ae29fd6ec4862ddfed8f466d184e01e78e06f2ced7aaf - C:\Users\analyst\AppData\Local\Temp\Unicorn-1566.exe -
cc4fa60bb12454c6e0474d22cc6c60d191f9e799f91cb75b66550edd26158ef7 - C:\Users\analyst\AppData\Local\Temp\Unicorn-27301.exe -
4995e06bf441ba99d3f41908c98891b3549ce7865a462ac320957cc0d1680724 - C:\Users\analyst\AppData\Local\Temp\Unicorn-49783.exe -
324cfef2b693a754b39f4c3efe35711a0e2c94870370fddcf660812bcaea389b - C:\Users\analyst\AppData\Local\Temp\Unicorn-30311.exe -
9784c22cf30a566bc95a1516082269b46e7bd2baffd24882f6af618bfcab6929 - C:\Users\analyst\AppData\Local\Temp\Unicorn-25896.exe -
558d3bfcfcae85ca2ae0dcd868afb40fbf57d54f0e3eadade84060cb5714a51b - C:\Users\analyst\AppData\Local\Temp\Unicorn-1230.exe -
0760c5e588624b8adc66116e62efec0502d49ff7f150fe99ebb89e29e98fecd4 - C:\Users\analyst\AppData\Local\Temp\Unicorn-17863.exe -
47d78c33f363d7e90ae5c0a19c9797c10459e79c9674fd0faa56a6380c4c4f0b - C:\Users\analyst\AppData\Local\Temp\Unicorn-50587.exe -
bd362d486ab512e367a1af8d9e04aac4df2829cd7d8b6ae3620b365ebef17f02 - C:\Users\analyst\AppData\Local\Temp\Unicorn-551.exe -
a4785b7c5b3af1c499bb93cd871aa114374fe75894520fd4ba6f8a80a399e9fa - C:\Users\analyst\AppData\Local\Temp\Unicorn-11272.exe -
c232cf2ad4e4f5c3a9c719a3cd6714bf8ee61931588ecaba5218b4fa0677bd54
Embedded URLs
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://ns.adobe.com/xap/1.0/
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/photoshop/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#
- http://www.iec.ch
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850654&P2=404&P3=2&P4=kEhOHMad2zS08tLLcTgnGpbllOdSUTQ1iEHrr0aQMhIit3oY7zWsSdHVcFY%2bSLnBpsI1q6j%2bfH%2frEz17rdJktg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850696&P2=404&P3=2&P4=NBvYCn9u294NV1Ck1QedCObsIX%2fPOTqpb5ujywkmeAoayu%2fGxGaiXuc%2b78dggqviTeLhjDMer4zxm%2fxQTrlQfg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787247476&P2=404&P3=2&P4=jFpTINsDk6MVLkN3XXEPnt3gtp7eqFAkUkAUZnuIWqt1khU%2fb9mobRb8iRbn4420wcWxc0ou9VrcRTHfI7Bggg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787247051&P2=404&P3=2&P4=EE2EIN9vyX2YOch5jOcXF%2fLcWZgFI35dmUpOgGcKOhRqqZSBI2ZCBcP5oxQtTHz5GiWvXxBHIyrLptYXVn97%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- ns.adobe.com
- www.w3.org
- purl.org
- www.iec.ch
Embedded IP addresses
- 13.69.116.109
- 52.123.252.245
- 4.144.132.114
- 4.247.188.224
- 4.230.171.124
- 52.123.252.222
- 135.233.95.144
- 20.184.175.18
- 74.178.240.51
- 52.123.128.14
- 20.112.250.133
- 52.123.129.14
- 203.26.79.13
- 135.233.45.221
- 52.123.252.225
- 74.178.76.44
- 52.123.252.195
- 52.123.252.247
- 52.148.114.188
- 4.247.188.233
- 20.184.175.20
- 51.104.15.253
- 72.145.35.103
- 52.168.117.170
- 48.192.143.121
File paths
- C:\Program
More Ajku samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report