SUSPICIOUS — virussign.com_eb86f5b461d97483aee3d68db74eb380.vir

SUSPICIOUS — virussign.com_eb86f5b461d97483aee3d68db74eb380.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (48/100). 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 75e690da7f95259f6cefb1721dbd3a025c06164b347b44fa60858f4c34ec010e
SHA-1: 5ede6b220b5b4f47685c829560c100d0b6f09cda
MD5: eb86f5b461d97483aee3d68db74eb380
imphash: 854a33c2898b67a55d7fc66a40d223a6
ssdeep: 1536:nUcJ2dk7WbyM3jfhi5yQ3wfsshIkzCAQSmp:nTJ2qWOqov3zs+ku7
TLSH: T1CA35029EC3206912C642C43EEC2D3D5D8B7996235BD8689DA60D470FBFD98F350A2C45
Submitted as: virussign.com_eb86f5b461d97483aee3d68db74eb380.vir
File type: pe · Size: 60416 bytes
Verdict: suspicious (48/100)

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (4 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.Barys.510186
Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.vho

MITRE ATT&CK

T1105

Why this verdict

The suspicious score of 48/100 is the fusion of 3 weighted signals:

Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

107 behavior events · 0 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tsk_794b31f3359240e1.exe - 536d530f33c1a2ec8ed8f9fc97f26883f8f226b6fedfe2b854456dcf4dc5c33a
86825fb79deefe4e817b3aa696452bf519116f7859ef7007a380a07734724d72 - 86825fb79deefe4e817b3aa696452bf519116f7859ef7007a380a07734724d72
6577bced8e6b4a8c1b39f877a6ec08a1f4773a79ef02fbed78b32e00db406897 - 6577bced8e6b4a8c1b39f877a6ec08a1f4773a79ef02fbed78b32e00db406897
5e7b7c58bf8ab1cdde1f4ba58ad419a18564b2d7179aa8915a256bef137d5c0f - 5e7b7c58bf8ab1cdde1f4ba58ad419a18564b2d7179aa8915a256bef137d5c0f
ccdb01e652904ca3402966c33c9e922bcb63ee071ed5d413b9c56a737ea77f2a - ccdb01e652904ca3402966c33c9e922bcb63ee071ed5d413b9c56a737ea77f2a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850667&P2=404&P3=2&P4=VqOCi%2f5u7izlOa9TfrL7F2INTCJ%2bEZPwaELUNxPw1Kf98ifIggbkm9xk1u0cPt0a39SuS27dXAUWgAP0Mkf03A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850723&P2=404&P3=2&P4=OWYXSDP8eG2%2bnbsk5OnHY9hoEN2jejnlYSdxDdLkucLtdOLyzo1Td1stMFgIYt98yzzTRavh9EoxeSqVB8%2f9sQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.30
52.123.252.222
85.210.196.11
4.230.171.124
4.144.132.114
85.210.193.152
52.230.59.222
135.233.95.144
74.178.240.51
4.150.223.100
52.123.252.218
20.236.44.162
52.123.129.14
52.123.128.14
20.184.175.18
203.26.79.13
172.178.240.162
52.123.252.235
74.178.76.44
52.110.12.20
52.110.12.53
52.148.114.188
52.123.252.192
20.89.1.10
52.168.117.174

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report