MALICIOUS — virussign.com_8e95e889b97aa069cb94b61b0047e730.vir

MALICIOUS — virussign.com_8e95e889b97aa069cb94b61b0047e730.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 5 of 55 detection engines flagged it.

Identification

SHA-256: a0bd49592677005d57d567506e79f6fb961d739fd1a1bb215543729f8b29fd71
SHA-1: 46a9307255e2659d3ce23b2d784c5c3c5a6cb82d
MD5: 8e95e889b97aa069cb94b61b0047e730
imphash: cdad71f00be06ad1b130e995c45f78b1
ssdeep: 3072:u3Q0oYZhTy08ln7/JCb46afZJkwWexWDn9H4OUzgAHvtSQ743Jl+:u3foD5lnlCM6afzIKIAHVn743
TLSH: T1374BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C689A7F17F7B98C5E1
Submitted as: virussign.com_8e95e889b97aa069cb94b61b0047e730.vir
File type: pe · Size: 479240 bytes
Verdict: malicious (93/100)

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: Trojan:Win32/Fareit!pz
Trellix Stinger (McAfee): Trojan-JBCL!8E95E889B97A
Kaspersky (KVRT): Trojan.Win32.VB.dosq

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

16432 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/Resou
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787734833&P2=404&P3=2&P4=b%2fWesoeObVttJ000o67KpysntKdroxR22NvOEcETigF3eyNQvyq53GhIcidtjGu7t0EP%2fRDzHxj0BOGwhvKHVA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787734898&P2=404&P3=2&P4=i%2fovmncEbrIEAHILuJ6uaaJmR%2fTErNZDqYSbwbHlJtY5rbJvhztgQxST82zjd2HmLuGrim334COd0XlKcouDuQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

203.26.79.13
52.123.252.236
20.165.94.63
135.233.95.135
4.230.171.124
4.247.188.224
4.144.132.114
4.150.223.114
20.42.65.89
40.99.133.226
20.76.201.171
52.123.128.14
172.66.2.5
85.210.193.152
135.233.45.221
162.159.142.9
135.233.95.80
52.148.114.188
172.217.25.195
57.155.101.212
20.184.175.11
51.116.253.170
72.153.5.132
52.110.12.54
52.110.12.22

File paths

C:\Program

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report