MALICIOUS — virussign.com_c96e0c267b2e4ff3500499f612f063b0.vir

MALICIOUS — virussign.com_c96e0c267b2e4ff3500499f612f063b0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Azov family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 8a858d92875c572df0a69bbd123ef9fdacba7977d06e573d0217a5c7253a5055
SHA-1: 81ea205fbd6372aaab05fe16f68703db4546ae00
MD5: c96e0c267b2e4ff3500499f612f063b0
imphash: 0f4f0c3e62a9e9cfa3fe2208af74764a
ssdeep: 6144:iJb5DLSj7zPgauBhYCoD82X94GnI2+e3zv07l3VoDd9WhXmw1SYaDYXpEX1UnEvn:tJLspSYnEv2GvXuYus980Z6GxfNxnHd
TLSH: T10C4E49C1D887A487C3ADD918D4A198DC883DB069F4B1C0A84652D1A99EFDD3371FB24B
Submitted as: virussign.com_c96e0c267b2e4ff3500499f612f063b0.vir
File type: pe · Size: 653277 bytes
Verdict: malicious (90/100) · Family: Azov

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:credential-access
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!C96E0C267B2E
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 90/100 is the fusion of 9 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

39 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

0cfd8044055272fbb517099225ada9833190cb933a29d5efdb21e395329c6bdb - 0cfd8044055272fbb517099225ada9833190cb933a29d5efdb21e395329c6bdb

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

104.46.162.229
4.144.132.114
172.215.188.232
4.230.171.124
57.155.104.224
135.233.95.144
4.150.223.109
74.178.76.54
74.179.77.204
4.150.223.111
20.236.44.162
162.159.142.9
52.123.129.14
52.123.128.14
135.233.45.223
203.26.79.13
72.153.5.63
74.178.232.29
52.148.114.188
52.110.12.32
52.110.12.49

More Azov samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report