MALICIOUS — virussign.com_3a688cb8c0fe8f6d277115d5388d2c00.vir

MALICIOUS — virussign.com_3a688cb8c0fe8f6d277115d5388d2c00.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Midie family. 4 of 55 detection engines flagged it.

Identification

SHA-256: 916f5d3358b29d70b5031b1b844a3d41f9c5a8e6f3a9247c3c35673dde2172e8
SHA-1: c0ca35162ef2e25f3fd78975642470be6ab94497
MD5: 3a688cb8c0fe8f6d277115d5388d2c00
imphash: 33f2c3f7f3e0e1ac776825f65a4bad4a
ssdeep: 3072:96hl5Jo9o9HMZ8y9h1V1TsVqrlvNqnmiu6:96/oks8y1Toqrl1qnmiu
TLSH: T1E5419FAF709249BFC30A63847BD018CC17E353DA21575CAAE148DA99D9B43FBAD90071
Submitted as: virussign.com_3a688cb8c0fe8f6d277115d5388d2c00.vir
File type: pe · Size: 188427 bytes
Verdict: malicious (93/100) · Family: Midie

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Midie-6847981-0
Microsoft Defender: TrojanDropper:Win32/Muldrop.V!MTB
Emsisoft (Emergency Kit): Gen:Heur.Conjar.9
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.pef

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Malware.Midie-6847981-0 (rule Win.Malware.Midie-6847981-0) - engine signal, weight 0.90, confidence 0.95
Contacted 25 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://ns.adobe.co, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

23654 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.co
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787733938&P2=404&P3=2&P4=iFxuPn7Bs1DpZLz76hy5r7uEEXlVBwizDgW3jb%2ft79I7f3yCcc%2f6oS5yuti8zpSYSZMgLlHpqy8n%2bGPBH3xUcg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787733989&P2=404&P3=2&P4=WuKzLaPQjREyCbiWuAsfkrMpb3691cOe1ATp9lR453WITlRPLiuH5Ma7%2fqmT0lnIj0QL8tk7llcdxz8gbHfjng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
ns.adobe.co
www.iec.ch

Embedded IP addresses

4.150.223.110
4.230.171.124
20.42.179.204
20.247.184.197
52.123.252.219
135.233.95.80
74.178.240.61
20.89.1.10
74.178.240.51
203.26.79.13
20.112.250.133
52.123.128.14
52.110.12.50
13.89.179.12
52.110.12.38
172.178.240.163
52.123.252.234
52.148.114.188
72.154.7.110
13.89.179.15
20.42.73.28
52.110.12.42
52.110.12.20
52.110.12.40
52.110.12.48

File paths

C:\Program

More Midie samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report