MALICIOUS — virussign.com_4d3fc7cd973878144f1c4d5ff95d9d50.vir

MALICIOUS — virussign.com_4d3fc7cd973878144f1c4d5ff95d9d50.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Fareit family. 5 of 55 detection engines flagged it.

Identification

SHA-256: a0309e22c7d4fc7de05623abe0f33d22c449ef95ffbe99d4805426863389fe9c
SHA-1: 2dc5cb71cad32bf796234e9fabe256472d81fee1
MD5: 4d3fc7cd973878144f1c4d5ff95d9d50
imphash: cdad71f00be06ad1b130e995c45f78b1
ssdeep: 3072:e4QboYZ1BIX8Enx/jPbLL7fhZBwVS5hbKCH4GxzIFsPcqzhn/glg:e4Yo7MEnhPfL7fzjChFsUohn/
TLSH: T1564BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C689A7F17F7B98C5E1
Submitted as: virussign.com_4d3fc7cd973878144f1c4d5ff95d9d50.vir
File type: pe · Size: 479244 bytes
Verdict: malicious (96/100) · Family: Fareit

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Trellix Stinger (McAfee): Trojan-JBCL!4D3FC7CD9738
Kaspersky (KVRT): Trojan.Win32.VB.dosq

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 26 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

19997 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/Resou
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787734549&P2=404&P3=2&P4=SEkrVaWhwKbT7HAxBgMKH0NjGflas5Oh6J%2fGjVN1X4e5hO2gYODt4n4%2fr%2fr5Kt5dRrprczo9tfq6DtYcEOPxaw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787734628&P2=404&P3=2&P4=HGikhZlvnSn2YZ6OJY2DFAfEiRA0gjdY9%2bhpxMUdXkI7Km%2fSVjLfIcRtNFIH6gCDpkong0%2boghwR5%2feaRIU7UA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

4.150.223.101
85.210.193.152
52.253.84.76
4.230.171.124
4.247.188.224
52.123.252.203
74.178.76.128
20.184.175.2
20.165.94.54
52.110.12.44
52.110.12.16
20.236.44.162
52.123.128.14
52.123.129.14
162.159.142.9
51.132.193.105
203.26.79.13
135.234.160.244
135.233.95.80
52.148.114.188
72.154.7.105
52.110.12.30
52.110.12.3
52.110.12.56
52.110.12.26

File paths

C:\Program

More Fareit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report