SUSPICIOUS — virussign.com_7d0fef803f99d10c93cc9714033e39f0.vir

SUSPICIOUS — virussign.com_7d0fef803f99d10c93cc9714033e39f0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (61/100), attributed to the Azov family. 4 of 55 detection engines flagged it.

Identification

• SHA-256: 9f89d2bc9d1d76560eeca2c4d21903ed72b0b0d1aca64cf1e449b46245822e5e
• SHA-1: 46f09b8d6d3bbe05c4c1cc33434bd49a247a315e
• MD5: 7d0fef803f99d10c93cc9714033e39f0
• imphash: 86e30125a507a776084efc08876b96be
• ssdeep: 12288:LJJKQy5LgVFMXUgduz2Xs9ti4lEFocJicj45:GcVFudMb3BG45
• TLSH: T1454C4B000503B7ABEBF7B6110D30579CF64771AA6A7D1B586B06E06E804FE2787D609E
• Submitted as: virussign.com_7d0fef803f99d10c93cc9714033e39f0.vir
• File type: pe · Size: 558645 bytes
• Verdict: suspicious (61/100) · Family: Azov

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (4 of 55 engines)

• Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
• Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
• Trellix Stinger (McAfee): Trojan-FXIH!7D0FEF803F99
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

Why this verdict

The suspicious score of 61/100 is the fusion of 2 weighted signals:

• Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
• Contacted 24 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

25 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com
• officeclient.microsoft.com

Dropped files

• a3c07fb2b6ad366180af72dffa60ecf1b6bfdfa56126f6538dfd0a247eac8314 - a3c07fb2b6ad366180af72dffa60ecf1b6bfdfa56126f6538dfd0a247eac8314

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded IP addresses

• 52.110.12.18
• 52.110.12.33
• 40.84.97.4
• 135.233.95.80
• 52.168.117.168
• 4.230.171.124
• 52.230.59.222
• 203.26.79.13
• 85.210.193.152
• 74.178.76.128
• 20.184.175.11
• 74.178.76.54
• 20.76.201.171
• 52.123.129.14
• 52.123.128.14
• 20.184.175.21
• 92.223.78.30
• 20.165.94.63
• 135.234.160.244
• 135.233.45.221
• 72.154.7.108
• 52.148.114.188
• 52.110.12.31
• 52.110.12.54

File paths

• t:\V

More Azov samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report