MALICIOUS — virussign.com_51f10da2abe3560c2b83fa41c047ba70.vir

MALICIOUS — virussign.com_51f10da2abe3560c2b83fa41c047ba70.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Fareit family. 5 of 55 detection engines flagged it.

Identification

SHA-256: 89aeae07690f795182f9e63ed27efbccb0ff2d9d97ec5c37cf0749ad85a9c7e2
SHA-1: fd0b1dd6b4f2e7c44cdb8f2a2e86a4b1a0da3500
MD5: 51f10da2abe3560c2b83fa41c047ba70
imphash: cdad71f00be06ad1b130e995c45f78b1
ssdeep: 3072:urO0oYg1TI08Un7/1Pb46ifhJkYzeVhtn/H4N3z1Vf5XLHznCal8:urFoY5UnJPM6ifKvWbVf1zznC
TLSH: T1F04BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C689A7F17F7B98C5E1
Submitted as: virussign.com_51f10da2abe3560c2b83fa41c047ba70.vir
File type: pe · Size: 479272 bytes
Verdict: malicious (96/100) · Family: Fareit

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Trellix Stinger (McAfee): Trojan-JBCL!51F10DA2ABE3
Kaspersky (KVRT): Trojan.Win32.VB.dosq

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 30 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

17810 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/Resou
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850948&P2=404&P3=2&P4=JzPQOs%2bKPP1VvgA8Je2dzCpYUnKAkbCDD56ABaeC7BTxjDl0TNkaHguy9W69w%2fqyz%2bz1DFKs6oA83MH8AQ8Bqg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787851003&P2=404&P3=2&P4=gFD35rOrkGEtLxEZroZJeaVOKypKmkRHrsyAI%2bMvoeHe298MSxnUPae2Fi1xc%2fs%2fsweN1yCtYgAQ4oN6MhiGuQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

40.84.85.40
20.42.65.88
52.123.252.245
52.123.252.223
4.230.171.124
20.42.179.204
20.247.184.197
74.178.76.128
52.182.141.63
135.232.92.97
74.178.240.61
52.168.112.66
203.26.79.13
20.76.201.171
52.123.252.242
40.99.133.210
52.123.129.14
52.123.252.194
135.232.92.34
135.234.160.246
172.215.188.225
20.42.65.85
52.148.114.188
135.233.45.222
72.154.7.112

File paths

C:\Program

More Fareit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report