MALICIOUS — virussign.com_a6537cc0140a1ee7ca0860bb39e6ac10.vir

MALICIOUS — virussign.com_a6537cc0140a1ee7ca0860bb39e6ac10.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Virlock family. 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 96d452277b6f5333ad532e5757680fb8c1e4ecde2b41fb5e9d8b8801db14a014
SHA-1: adc189fd5d43ea77306a3cae6f44d2a83473eace
MD5: a6537cc0140a1ee7ca0860bb39e6ac10
imphash: 0fc40c123ff7fa29e3d6971297be5667
ssdeep: 12288:jR5u7/pseVT92etHV8Ja9t0dJW4l08sE+tZ1lGh:+T9VT9Rt1qLdJW4l08sEnh
TLSH: T12E4BF1E0A9DD05FBD410B50E96B87E0EE5BFA2D601290CC81B85F7BC632015B6C95F4A
Submitted as: virussign.com_a6537cc0140a1ee7ca0860bb39e6ac10.vir
File type: pe · Size: 502784 bytes
Verdict: malicious (99/100) · Family: Virlock

Source: VirusSign · first seen 2026-07-22T00:00:00.000Z · SHA-256 verified

Detections (6 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Virus.Virlock-6804475-0
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.1
Kaspersky (KVRT): Virus.Win32.PolyRansom.b
Trellix Stinger (McAfee): W32/VirRansom.b

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Virus.Virlock-6804475-0 (rule Win.Virus.Virlock-6804475-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7692) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.1 (rule Win32.Virlock.Gen.1) - engine signal, weight 0.55, confidence 0.85
Extracted VirLock config (0 C2) - engine signal, weight 0.45, confidence 0.60
Extracted VirLock config (0 C2) - engine signal, weight 0.45, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

244 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/2959/files/d0098926310fecc34a45acc3c4ca99a46ed8253191b53bf4546801fb0355cc47 - d0098926310fecc34a45acc3c4ca99a46ed8253191b53bf4546801fb0355cc47
/opt/CAPEv2/storage/analyses/2959/files/6bde3523a45b389327f044413eca7c15696e53b509f70a12149c427c7d2f3a0c - 6bde3523a45b389327f044413eca7c15696e53b509f70a12149c427c7d2f3a0c
a2350e29a548a91234c16501fe1a6558bb3db7b96921f8c723f8c29c44348bdd - a2350e29a548a91234c16501fe1a6558bb3db7b96921f8c723f8c29c44348bdd

Embedded domains

staging.to-do.officeppe.com
searchapp.bundleassets.example
www.msftconnecttest.com
www.bing.com
tas02.sls.update.microsoft.com
aps.prod.windows.com
config.edge.skype.com
ctldl.windowsupdate.com
settings-win.data.microsoft.com
to-do.microsoft.com
dns.msftncsi.com
staging.to-do.microsoft.com
edge.microsoft.com
watson.events.data.microsoft.com
teams.microsoft.com

More Virlock samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report