MALICIOUS — virussign.com_05a2502ba9b661506bd5c633b05d4f90.vir

MALICIOUS — virussign.com_05a2502ba9b661506bd5c633b05d4f90.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Viking family. 9 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 7b5d0a4a33145a38415c9dc3f77b15f54ede66428d2f644ba823d8d727122237
• SHA-1: fc212bfe5ff311193fa77ba0298c9035d2a1137a
• MD5: 05a2502ba9b661506bd5c633b05d4f90
• imphash: 58898ae62a4a48cab5ad1028a9dbc8ba
• ssdeep: 6144:irQ+hMnoz/F5HMinY2gzoEfyIiSW/jmBbK0b4ynjjH8IcoFx/rJcK4t:irDMoz/nHqoVjmBG0x4t
• TLSH: T11B4949CD422EA301DB35C7385D607EEE58A5B4C562B9764C4E57427E01E302BFD328AA
• Submitted as: virussign.com_05a2502ba9b661506bd5c633b05d4f90.vir
• File type: pe · Size: 394672 bytes
• Verdict: malicious (99/100) · Family: Viking

Source: VirusSign · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (9 of 52 engines)

• capa (capabilities): capability:collection/keylog
• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Worm.Viking-2243
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:UPX 1.20
• Microsoft Defender: Virus:Win32/Viking.LZ
• Emsisoft (Emergency Kit): Generic.Viking.7A645FCE
• Kaspersky (KVRT): Worm.Win32.Viking.al

MITRE ATT&CK

• T1071.001
• T1056.001

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

• ClamAV (daily) flagged Win.Worm.Viking-2243 (rule Win.Worm.Viking-2243) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Virus:Win32/Viking.LZ (rule Virus:Win32/Viking.LZ) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Viking.7A645FCE (rule Generic.Viking.7A645FCE) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:UPX 1.20 (rule DIE:UPX 1.20) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: 4.0.0.2 - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Packing/obfuscation: UPX, high-entropy-sections:UPX1, UPX 1.20 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://crl.verisign.com/tss-ca.crl0
• https://www.verisign.com/rpa
• https://www.verisign.com/cps0*
• https://www.verisign.com/rpa0
• http://logo.verisign.com/vslogo.gif0
• http://crl.verisign.com/pca3.crl0

Embedded domains

• crl.verisign.com
• www.verisign.com
• logo.verisign.com
• csc3-2009-2-crl.verisign.com
• csc3-2009-2-aia.verisign.com

Embedded IP addresses

• 4.0.0.2

File paths

• f:\sp\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
• f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
• f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
• f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
• f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
• f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
• f:\sp\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
• g:\acro_root_nsp\acrobat\installers\bootstrapexe_small\release\Setup.pdb

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report