MALICIOUS — virussign.com_bf42d71f15e1ef1cb9fdbe74e5a66580.vir
MALICIOUS — virussign.com_bf42d71f15e1ef1cb9fdbe74e5a66580.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Redirector family. 2 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
73a1e324f2e9b816c23e65732853b74ab2b51d545d56d51632a1fb3976aac87d - SHA-1:
ddb404ec5cc809369d5c9bd6ffc5dbb7ab0d2569 - MD5:
bf42d71f15e1ef1cb9fdbe74e5a66580 - ssdeep:
96:nItDJYtoAJS8ffKH1NPIX4rDJcs01cq4o5nZSX21epKED7B6YI:IVJYtoA1ffqzr/Jcs0BbSG1ego7I - TLSH:
T1451A09E7BC4AFFDD8C8801679C6634BB231396657A8066D481FEA3549DF0C981C1C898 - Submitted as: virussign.com_bf42d71f15e1ef1cb9fdbe74e5a66580.vir
- File type: html · Size: 4721 bytes
- Verdict: malicious (95/100) · Family: Redirector
Source: VirusSign · first seen 2026-07-17T00:00:00.000Z · SHA-256 verified
Detections (2 of 51 engines)
- Microsoft Defender: Trojan:HTML/Redirector.E!AMTB
- Emsisoft (Emergency Kit): Adware.JS.Redirector.1
MITRE ATT&CK
Why this verdict
The malicious score of 95/100 is the fusion of 9 weighted signals:
- Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7832) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:HTML/Redirector.E!AMTB (rule
Trojan:HTML/Redirector.E!AMTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Adware.JS.Redirector.1 (rule
Adware.JS.Redirector.1) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://router.parklogic.com/, 90.187.238.157 - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
279 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- desktop-hsgcbep
- www.bing.com
- edge.microsoft.com
- aps.prod.windows.com
- dns.msftncsi.com
- ecs.office.com
- g.live.com
- fs.microsoft.com
- self.events.data.microsoft.com
- www.msftncsi.com
- geo.prod.do.dsp.mp.microsoft.com
- geover.prod.do.dsp.mp.microsoft.com
- watson.events.data.microsoft.com
- 192.168.122.106
- 224.0.0.252
- 192.168.122.255
- 192.168.122.1
- 239.255.255.250
- 192.168.122.105
Dropped files
- ab619a4fcd4b20ee15b319afdda0a8af0c30881ec2c2d996d88ade01c1e87724 -
ab619a4fcd4b20ee15b319afdda0a8af0c30881ec2c2d996d88ade01c1e87724
Embedded URLs
- https://router.parklogic.com/
Embedded domains
- t.info
- router.parklogic.com
- o.name
- laosvegas888-asadee57.site
- www.msftconnecttest.com
- www.bing.com
- edge.microsoft.com
- aps.prod.windows.com
- dns.msftncsi.com
- ecs.office.com
- g.live.com
- fs.microsoft.com
- self.events.data.microsoft.com
- www.msftncsi.com
- geo.prod.do.dsp.mp.microsoft.com
- geover.prod.do.dsp.mp.microsoft.com
- watson.events.data.microsoft.com
Embedded IP addresses
- 90.187.238.157
More Redirector samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report