SUSPICIOUS — virussign.com_312353a09b3e01c38ecc8785ec64bf50.vir

SUSPICIOUS — virussign.com_312353a09b3e01c38ecc8785ec64bf50.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (40/100), attributed to the HUILoader family. 2 of 51 detection engines flagged it.

Identification

SHA-256: 854ebefebf7b09b629e4f3e44ec039fe5fb7f211420763b1385e609ebd0aa188
SHA-1: 254e03c0b936ed2182402b5b195842c3f56a6cc1
MD5: 312353a09b3e01c38ecc8785ec64bf50
imphash: 88016fcdef7f227c62171d0afad9aae4
ssdeep: 12288:JPLY0FnuUkWan0XKyxy649dnTzvlpQ2zTz2sTI:JPpFnuAs0XKyxyRhzvLZI
TLSH: T1A85117EA361B7612C718A3111163AE3E88E7EC46227B584B05E2971FD6F4613F5F0293
Submitted as: virussign.com_312353a09b3e01c38ecc8785ec64bf50.vir
File type: pe · Size: 877056 bytes
Verdict: suspicious (40/100) · Family: HUILoader

Source: VirusSign · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (2 of 51 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged

Why this verdict

The suspicious score of 40/100 is the fusion of 2 weighted signals:

YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
https://jrsoftware.org/ishelp/index.php?topic=setupcmdline

Embedded domains

schemas.microsoft.com
jrsoftware.org

File paths

T:\:d:l:p:t:x:
X:\:`:d:h:l:p:t:x:
N:\:k:
E:\:
X:\:`:h:p:x:
U:\:c:j:t:
T:\:j:x:
T:\:d:l:t:
D:\Coding\Is\issrc-build\Components\ChaCha20.pas
x:\dirname

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report