MALICIOUS — virussign.com_e039a0a630c612fefa3415d36bb84190.vir

MALICIOUS — virussign.com_e039a0a630c612fefa3415d36bb84190.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Socks family. 7 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8246a785637ccb8a4e4ad7151d5f3294ccabc05ff2692af9c597ca7e75994c16
SHA-1: 8bf5b04ea72e90518697cfe25d1d6589dfc59316
MD5: e039a0a630c612fefa3415d36bb84190
imphash: 178689c38c1294cbf87aafcafb2357ed
ssdeep: 12288:ACV7Wjbk2muX8drloF6NdfEWSIOsRCFyK/OOArV8gnIHbGcfK:AjAxuUesEWSIO86ynrDcGt
TLSH: T1AD5023C591C5F402FE2AE11C75A9112E9DB43D8CF13CF69BE8045912ABF704BB1A18A7
Submitted as: virussign.com_e039a0a630c612fefa3415d36bb84190.vir
File type: pe · Size: 768891 bytes
Verdict: malicious (100/100) · Family: Socks

Source: VirusSign · first seen 2026-07-18T00:00:00.000Z · SHA-256 verified

Detections (7 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Worm.Socks-10058896-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:UPX 3.02
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
Microsoft Defender: Worm:Win32/Autorun
Emsisoft (Emergency Kit): Trojan.Stealer.557

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Worm.Socks-10058896-0 (rule Win.Worm.Socks-10058896-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in powershell.exe (pid 2512) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.02 (rule DIE:UPX 3.02) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, UPX 3.02 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9450 behavior events · 2 ATT&CK techniques · 15 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3656/files/f0ca3882ae7557743d141f23653919f99b263f340fdbf1066f8885fdb4a0847e - f0ca3882ae7557743d141f23653919f99b263f340fdbf1066f8885fdb4a0847e
/opt/CAPEv2/storage/analyses/3656/files/95257f5375ac50296a66bb9e1ce2d3c7f7a4c4ca0c6ca89194d32a72332be000 - 95257f5375ac50296a66bb9e1ce2d3c7f7a4c4ca0c6ca89194d32a72332be000
/opt/CAPEv2/storage/analyses/3656/files/2a7578912243a102faf3ef1f1376412e337aa2c18cc078093dbe577f2d27f7a1 - 2a7578912243a102faf3ef1f1376412e337aa2c18cc078093dbe577f2d27f7a1
/opt/CAPEv2/storage/analyses/3656/files/f597f4d2a200c597486ee6f5789864c2f070c130235b209269c9de085181df54 - f597f4d2a200c597486ee6f5789864c2f070c130235b209269c9de085181df54
/opt/CAPEv2/storage/analyses/3656/files/040c7c5e1e838be2e497e981254b8ed3ce4311151a6a8e0836ae11b7ed9b5675 - 040c7c5e1e838be2e497e981254b8ed3ce4311151a6a8e0836ae11b7ed9b5675
/opt/CAPEv2/storage/analyses/3656/files/50412ddc6a73fab0f3c891a99b831a7b90db9b3daf5867ffee3d15d5db7f89dd - 50412ddc6a73fab0f3c891a99b831a7b90db9b3daf5867ffee3d15d5db7f89dd
/opt/CAPEv2/storage/analyses/3656/files/3a3786205382cf836abfaeb18f47c2ad3f24cd225cb1054c3de4097cc44a870f - 3a3786205382cf836abfaeb18f47c2ad3f24cd225cb1054c3de4097cc44a870f
/opt/CAPEv2/storage/analyses/3656/files/f4e78e82242b37b2c489d90db4c502f4e5774bc9802defdab25cc1a6caa78126 - f4e78e82242b37b2c489d90db4c502f4e5774bc9802defdab25cc1a6caa78126
/opt/CAPEv2/storage/analyses/3656/files/508dc82c00a122da94f98e5db7baec9e786bb0b36d1c783e71ffdd52a91a47f5 - 508dc82c00a122da94f98e5db7baec9e786bb0b36d1c783e71ffdd52a91a47f5
/opt/CAPEv2/storage/analyses/3656/files/7f77674662cd64f4bb686e755d3bf2d0b5833a6d71d007efd620a204862a84d9 - 7f77674662cd64f4bb686e755d3bf2d0b5833a6d71d007efd620a204862a84d9
/opt/CAPEv2/storage/analyses/3656/files/44aa2520f67d1f7a73a7f033afb0786273e4255e94e993641b80980bf340cfc5 - 44aa2520f67d1f7a73a7f033afb0786273e4255e94e993641b80980bf340cfc5
/opt/CAPEv2/storage/analyses/3656/files/708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c - 708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c
/opt/CAPEv2/storage/analyses/3656/files/8da12ca4c81b3f930c922d3268e93e5c040353235c6b3162c569b71b9449f069 - 8da12ca4c81b3f930c922d3268e93e5c040353235c6b3162c569b71b9449f069
/opt/CAPEv2/storage/analyses/3656/files/9930124118bb2fa45af3e1092f644a9fb75e6dd22a885ae68757bb26a23226fa - 9930124118bb2fa45af3e1092f644a9fb75e6dd22a885ae68757bb26a23226fa
ea68ef217d246f0bc37cd7974b8f2539e8adc13d45cdebb336186739aca2638d - ea68ef217d246f0bc37cd7974b8f2539e8adc13d45cdebb336186739aca2638d

Embedded domains

bublikiadministrator.com
bublikimanager.com
www.msftconnecttest.com
config.edge.skype.com
dns.msftncsi.com
www.bing.com
edge.microsoft.com
aps.prod.windows.com
watson.events.data.microsoft.com
ecs.office.com
www.msftncsi.com
g.live.com
self.events.data.microsoft.com
fs.microsoft.com

More Socks samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report