MALICIOUS — virussign.com_47bccfc65ce107036b87f38c8dcb0990.vir

MALICIOUS — virussign.com_47bccfc65ce107036b87f38c8dcb0990.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the BlackMoon family. 7 of 55 detection engines flagged it.

Identification

• SHA-256: 75fb9b0f95f8c7aac7824cb8dce707bf8cd0aec7ee1864b74732db8b65a24eb7
• SHA-1: 1ed87c7a54b5af6452ed1d2ba7c38b9cf57d3c82
• MD5: 47bccfc65ce107036b87f38c8dcb0990
• imphash: 9dacd5fc505421be83fd9ef325d44b59
• ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZm5f:0cdpeeBSHHMHLf9RyIEQ5KXZ8
• TLSH: T19A3A0AA396A3B489C93470AB3B4F7351B0007DF00653799625ACE29FBE675CB46834C6
• Submitted as: virussign.com_47bccfc65ce107036b87f38c8dcb0990.vir
• File type: pe · Size: 93542 bytes
• Verdict: malicious (93/100) · Family: BlackMoon

Source: VirusSign · first seen 2026-08-15T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
• ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
• YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
• Detect It Easy (packer/type): DIE:MPRESS
• Microsoft Defender: Trojan:Win32/Blackmoon!rfn
• Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97
• Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
• YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report