MALICIOUS — virussign.com_21d8ee54358aeb6bd4b80e048c318980.vir

MALICIOUS — virussign.com_21d8ee54358aeb6bd4b80e048c318980.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the PyInstaller family. 7 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 8663d7161e7dfc87bb5a6af9d6084f8582331c7e26627f93280c0b3b07b3e051
• SHA-1: b250980299a4b37cb789a3dc1b345a3703cc4505
• MD5: 21d8ee54358aeb6bd4b80e048c318980
• imphash: b9aff912a075cd9014ac7f401226f8e5
• ssdeep: 98304:IFQeMBLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:7eEZF6bUpMBF1p/kjRm4OWi2b
• TLSH: T1F666336E0A5AF543FAF6954469C00C2F29A360C74DBD8D09498BC17F7AD2977E230C1A
• Submitted as: virussign.com_21d8ee54358aeb6bd4b80e048c318980.vir
• File type: pe · Size: 6569428 bytes
• Verdict: malicious (99/100) · Family: PyInstaller

Source: VirusSign · first seen 2026-07-17T00:00:00.000Z · SHA-256 verified

Detections (7 of 53 engines)

• capa (capabilities): beacon to command-and-control
• MalwareAnalyser heuristics (entropy/packer): PyInstaller
• ClamAV (daily): Win.Malware.Generic-6651554-0
• Detect It Easy (packer/type): DIE:PyInstaller
• Microsoft Defender: Virus:Win32/Sality.AT
• Emsisoft (Emergency Kit): Win32.Sality.3
• Kaspersky (KVRT): Virus.Win32.Sality.sil

MITRE ATT&CK

• T1071.001
• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged Win.Malware.Generic-6651554-0 (rule Win.Malware.Generic-6651554-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 3 finding(s), e.g. RWX/private injected region in sihost.exe (pid 4312) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Virus:Win32/Sality.AT (rule Virus:Win32/Sality.AT) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Sality.3 (rule Win32.Sality.3) - engine signal, weight 0.55, confidence 0.85
• beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
• Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12598 behavior events · 1 ATT&CK techniques · 9 dropped files.

Runtime network

• www.msftconnecttest.com
• searchapp.bundleassets.example
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• desktop-hsgcbep
• config.edge.skype.com
• www.bing.com
• fd.api.iris.microsoft.com
• aps.prod.windows.com
• tas02.sls.update.microsoft.com
• dns.msftncsi.com
• settings-win.data.microsoft.com
• to-do.microsoft.com
• ctldl.windowsupdate.com
• staging.to-do.microsoft.com
• ecs.office.com
• edge.microsoft.com
• g.live.com
• self.events.data.microsoft.com

Dropped files

• /opt/CAPEv2/storage/analyses/3585/files/195653cf1a7dc97c08a7339a5419153f3149b03567c0833eed14834825b27181 - 195653cf1a7dc97c08a7339a5419153f3149b03567c0833eed14834825b27181
• /opt/CAPEv2/storage/analyses/3585/files/6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b - 6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b
• /opt/CAPEv2/storage/analyses/3585/files/a840546d81510eb6bada654e8695b63475e184cb5bd89d6873229b7160c2d8c4 - a840546d81510eb6bada654e8695b63475e184cb5bd89d6873229b7160c2d8c4
• 65cd17fbc47adbd662b47bf9c477eec55153931243b9bdcbe17134e34c1e0828 - 65cd17fbc47adbd662b47bf9c477eec55153931243b9bdcbe17134e34c1e0828
• b7b183950e4e34e5f3c531142687e0f0731041aa7f35a3308ed86546496ce278 - b7b183950e4e34e5f3c531142687e0f0731041aa7f35a3308ed86546496ce278
• 2c74c4c828dbdfb69f37dfc37435155fcc301908ff567869043aed1f99cf059a - 2c74c4c828dbdfb69f37dfc37435155fcc301908ff567869043aed1f99cf059a
• a9e23459375b1234a851538e8de666bf23d47fa3d0ccf63b2c96f2f2205bf1fe - a9e23459375b1234a851538e8de666bf23d47fa3d0ccf63b2c96f2f2205bf1fe
• 1d9f24cbd4a794801355a816b0d6d34ffc846ba17e296782984fcba84d2feaf4 - 1d9f24cbd4a794801355a816b0d6d34ffc846ba17e296782984fcba84d2feaf4
• 8b812e4a997bde6bd4e2ba37e6c50fc593c420d028727182e36ace28da26dfe5 - 8b812e4a997bde6bd4e2ba37e6c50fc593c420d028727182e36ace28da26dfe5

Embedded domains

• 2.to
• j.pro
• i.ai
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• www.msftconnecttest.com
• searchapp.bundleassets.example
• outlook.office.com
• config.edge.skype.com
• www.bing.com
• fd.api.iris.microsoft.com
• aps.prod.windows.com
• tas02.sls.update.microsoft.com
• dns.msftncsi.com
• settings-win.data.microsoft.com
• to-do.microsoft.com
• ctldl.windowsupdate.com
• staging.to-do.microsoft.com
• ecs.office.com
• edge.microsoft.com
• g.live.com
• self.events.data.microsoft.com
• teams.microsoft.com
• fs.microsoft.com
• www.msftncsi.com

File paths

• T:\:d:l:t:
• d:\+9y

More PyInstaller samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report