MALICIOUS — virussign.com_76b3708b041a3e38e9c8704e4e98a8c0.vir
MALICIOUS — virussign.com_76b3708b041a3e38e9c8704e4e98a8c0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the Sabsik family. 1 of 53 detection engines flagged it.
Identification
- SHA-256:
9f8388448cdcf4c6ea2fccfa3a4fbb5b7dddc6e272e139b964a9c963dee98226 - SHA-1:
c30ee8845078c91c751c31776c4dd5f81202e2ba - MD5:
76b3708b041a3e38e9c8704e4e98a8c0 - imphash:
aacd8ae9f2b99c68ac8a18a3a1fb333c - ssdeep:
1536:W5USYNNRy7iNah+WWOMzbJHYXyigBOwlFhDKTLggIaBdA6Cmk+/:kUSduNaXhggIaV/ - TLSH:
T1D93C3B55677C3F60CEF4ED005898CA6DA622984A24BDABDC2703D637A57C3B3057640B - Submitted as: virussign.com_76b3708b041a3e38e9c8704e4e98a8c0.vir
- File type: pe · Size: 122827 bytes
- Verdict: malicious (88/100) · Family: Sabsik
Source: VirusSign · first seen 2026-07-23T00:00:00.000Z · SHA-256 verified
Detections (1 of 53 engines)
- Microsoft Defender: Trojan:Win32/Sabsik.FL.A!ml
Why this verdict
The malicious score of 88/100 is the fusion of 4 weighted signals:
- Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7164) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Win32/Sabsik.FL.A!ml (rule
Trojan:Win32/Sabsik.FL.A!ml) - engine signal, weight 0.55, confidence 0.85 - Contacted 33 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
- Contacted 33 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Dynamic analysis (windows)
18 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- searchapp.bundleassets.example
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.msftconnecttest.com
- www.bing.com
- to-do.microsoft.com
- ctldl.windowsupdate.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- oneocsp.microsoft.com
- config.edge.skype.com
- staging.to-do.microsoft.com
- teams.microsoft.com
- dns.msftncsi.com
- officeclient.microsoft.com
- v10.events.data.microsoft.com
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785788971&P2=404&P3=2&P4=YwKLP9eieIqeDViV1CW3zhGrv81hFzo2Qs%2fxH5yk0MHb%2foQd8adB8l8lncaic%2bnDxhVAsXNdQo5eyxbufXn95w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.cloud.microsoft
- searchapp.bundleassets.example
- to-do.office.com
- outlook.office.com
- outlook.office365.com
- www.msftconnecttest.com
- www.bing.com
- to-do.microsoft.com
- ctldl.windowsupdate.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- oneocsp.microsoft.com
- config.edge.skype.com
- staging.to-do.microsoft.com
- teams.microsoft.com
- dns.msftncsi.com
- officeclient.microsoft.com
- v10.events.data.microsoft.com
- odc.officeapps.live.com
- aps.prod.windows.com
- v20.events.data.microsoft.com
- watson.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
Embedded IP addresses
- 23.33.238.114
- 57.155.104.224
- 150.171.22.17
- 20.42.179.192
- 20.76.201.171
- 52.98.143.66
- 52.123.129.14
- 23.11.37.157
- 52.98.142.162
- 131.253.33.203
- 52.98.128.130
- 23.40.52.209
- 23.40.52.85
- 20.42.72.131
- 20.42.179.204
- 135.233.45.221
- 52.123.252.241
- 135.233.95.144
- 135.233.95.135
- 135.232.92.137
- 20.42.73.31
- 203.26.79.13
- 150.171.27.11
- 23.221.133.185
- 52.110.12.26
More Sabsik samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report