MALICIOUS — virussign.com_1d983258d4585c547b36571e4be75d50.vir

MALICIOUS — virussign.com_1d983258d4585c547b36571e4be75d50.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Sality family. 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 81a21d83b56bd449d47ed6f02db59e0d434f1be68435bb86c4cb9604374f3b27
SHA-1: 4039a24404df2b629faf8459d7367ac02b6e1884
MD5: 1d983258d4585c547b36571e4be75d50
imphash: de8b7e508ea4346913fa27a6b3f5d695
ssdeep: 3072:bz+DePj3CIUdoj1p/filrEjHODVbpEqyLB/0ooJav9ywJcWbzf0/O70Wyjy6:uD3IUdSp/3uDVVU0Tav9YQM270fW6
TLSH: T1A940CFCE811B3281E5B6D6546C848DDCD873F2AD6832E94C5E03C85DB0D0AB7C9B166E
Submitted as: virussign.com_1d983258d4585c547b36571e4be75d50.vir
File type: pe · Size: 173926 bytes
Verdict: malicious (99/100) · Family: Sality

Source: VirusSign · first seen 2026-07-20T00:00:00.000Z · SHA-256 verified

Detections (6 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:3
ClamAV (daily): Win.Trojan.Sality-1011
Detect It Easy (packer/type): DIE:UPX 0.70
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Win32.Sality.D
Kaspersky (KVRT): Virus.Win32.Sality.d

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Sality-1011 (rule Win.Trojan.Sality-1011) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8164) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Sality.D (rule Win32.Sality.D) - engine signal, weight 0.55, confidence 0.85
Detect It Easy (packer/type) flagged DIE:UPX 0.70 (rule DIE:UPX 0.70) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:3 , UPX 0.70 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

188 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/2835/files/d769dd2bf6dd873382dba6fabb64fb18cc4862a51058dcd173d09c5deed9e69a - d769dd2bf6dd873382dba6fabb64fb18cc4862a51058dcd173d09c5deed9e69a
/opt/CAPEv2/storage/analyses/2835/files/86c37d531bdec92247c60d88a836074249f45a0f3b124f0ac03df8214779d701 - 86c37d531bdec92247c60d88a836074249f45a0f3b124f0ac03df8214779d701

Embedded domains

staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.cloud.microsoft
searchapp.bundleassets.example
www.msftconnecttest.com
outlook.office.com
outlook.office365.com
www.bing.com
config.edge.skype.com
dns.msftncsi.com
to-do.microsoft.com
settings-win.data.microsoft.com
ctldl.windowsupdate.com
staging.to-do.microsoft.com
edge.microsoft.com
teams.microsoft.com
aps.prod.windows.com
watson.events.data.microsoft.com
g.live.com
ecs.office.com
fs.microsoft.com
self.events.data.microsoft.com
www.msftncsi.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com

File paths

C:\Projects\sandbox-2\sandbox\build\release\agent.pdb

More Sality samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report