SUSPICIOUS — virussign.com_3558fceccd9a1604f717dcc9e56f8fe0.vir

SUSPICIOUS — virussign.com_3558fceccd9a1604f717dcc9e56f8fe0.vir is a zip sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 54 detection engines flagged it.

Identification

• SHA-256: 93bff56574aaff6751ce54768cd933bec2118ec24f74d0e8ae5eed655dd307e4
• SHA-1: 28806af8ac091ce958a91a0e55c8eea81408c899
• MD5: 3558fceccd9a1604f717dcc9e56f8fe0
• ssdeep: 12288:Y2iZkmLG4BwUcpLXl8Xi9b5S+06id46lst1njp7mubGL++6rr7UnZCE/:skQxB6pJ8Xi6+oe6Gj1m8GLMUZP
• TLSH: T12450235EF7C942AB2262EF4AB2155F96994DD06C3FE9873028C062DF253C0B58C597C8
• Submitted as: virussign.com_3558fceccd9a1604f717dcc9e56f8fe0.vir
• File type: zip · Size: 817824 bytes
• Verdict: suspicious (35/100)

Source: VirusSign · first seen 2026-08-29T00:00:00.000Z · SHA-256 verified

Detections (1 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

Why this verdict

The suspicious score of 35/100 is the fusion of 3 weighted signals:

• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• archive:unopenable — contents were NOT scanned: listing failed: Command failed: 7zz l -slt -pzippw -- /tmp/tl-collect-JTq6JN/sample.archive - static signal, weight 0.00, confidence 0.00

Dynamic analysis

This zip is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

Embedded domains

• q.gq

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report