MALICIOUS — virussign.com_1b7785cc8e2c037414350770612696c0.vir

MALICIOUS — virussign.com_1b7785cc8e2c037414350770612696c0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the Maldoc family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 7189168e229c01f35c77ac056267a11fefcd4aa4bac9666aa7d27e8afd357f1c
SHA-1: 6aa402899d04835158162b2d619dc1158e0c72eb
MD5: 1b7785cc8e2c037414350770612696c0
imphash: d058de892eb271cb836fb7509a04426e
ssdeep: 12288:j2SpSYnEv2GvOx5s9pZOU1tAjl9+QZiwlKPK9pq8:jXpFnEvKwOUv6HKPi
TLSH: T1DC4E5BC1D887958BC3A8D608D4E198DC483DF0A5F0B1C1A85652E1A9ADFCD3371BB64B
Submitted as: virussign.com_1b7785cc8e2c037414350770612696c0.vir
File type: pe · Size: 650149 bytes
Verdict: malicious (82/100) · Family: Maldoc

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:credential-access
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!1B7785CC8E2C
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 82/100 is the fusion of 8 weighted signals:

access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

d76dca34fcbbb5ad1e6dbfb4adf820994e66d633d8c560a4d84ec703488131d0 - d76dca34fcbbb5ad1e6dbfb4adf820994e66d633d8c560a4d84ec703488131d0

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787733716&P2=404&P3=2&P4=Vp19avHjKWyWFhRN5ftG4ebVaYoCORYxTVDp6YfNKHS7Nf9LQGy3K%2bgjOiQXlJFcw3ppDMJnL7OZYzik6UDd6A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

52.168.117.175
20.247.185.124
4.230.171.124
85.210.196.11
135.233.95.80
135.232.92.137
74.178.76.54
51.11.192.49
203.26.79.13
20.42.73.31
20.76.201.171
40.103.64.242
52.123.128.14
40.104.4.2
20.165.94.46
135.233.45.222
92.223.78.30
72.154.7.101
52.110.12.5
52.110.12.33
52.148.114.188

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report