MALICIOUS — virussign.com_3bc54f13147be0ab6ad91b8d49f298d0.vir

MALICIOUS — virussign.com_3bc54f13147be0ab6ad91b8d49f298d0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Berbew family. 5 of 51 detection engines flagged it.

Identification

SHA-256: 8dc9fb1b2a861d8a7966483ae18b5c5d494f7b57a6dadb023dbf381d0a8621e6
SHA-1: e0c32f50b9e6bddc3ed18a6e73cf573ae2f1292f
MD5: 3bc54f13147be0ab6ad91b8d49f298d0
imphash: 7e1663fe05d1b77d0d5def29829c4221
ssdeep: 1536:b3HbPqnzmj1cDqH3PH28L576Isw6mVUAK/Tgy9LQDM/2L0JES5DUHRbPa9b6i+sX:bcHD8fzIzEN0CS5DSCopsIk
TLSH: T18F386B23E7645D25CCE6859ED095BD2CD8D0126A3D341870C29DE9B4FC376DBA80C29B
Submitted as: virussign.com_3bc54f13147be0ab6ad91b8d49f298d0.vir
File type: pe · Size: 81920 bytes
Verdict: malicious (87/100) · Family: Berbew

Source: VirusSign · first seen 2026-07-28T00:00:00.000Z · SHA-256 verified

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Dropper.Berbew-10009572-0
Microsoft Defender: Trojan:Win32/Cerber!pz
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.DF600D2E
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vih

Why this verdict

The malicious score of 87/100 is the fusion of 2 weighted signals:

ClamAV (daily) flagged Win.Dropper.Berbew-10009572-0 (rule Win.Dropper.Berbew-10009572-0) - engine signal, weight 0.90, confidence 0.95
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

http://oracle.com/contracts
http://www.oracle.com/education/oln

Embedded domains

www.oracle.com
microsoft.com
go.microsoft.com
oracle.com
o15.officeredir.microsoft.com

More Berbew samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report