MALICIOUS — virussign.com_e6f0e6fd4e1b011a6e3de8f97fd2c470.vir
MALICIOUS — virussign.com_e6f0e6fd4e1b011a6e3de8f97fd2c470.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Virlock family. 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a292d15a273d756a57ed7bb4ae81995a784f0130807e77ceb808aa3b7b108672 - SHA-1:
598d1db0fe35171a018e81fb5cec5efc94f1acdb - MD5:
e6f0e6fd4e1b011a6e3de8f97fd2c470 - imphash:
41b2ad851e3236f2dd08a867f7d7f6c3 - ssdeep:
12288:bHaM0BUJOi5gPnBl2yZpZzZvyR+4GNVf+0d:LaW5gPrZyR9GNV20d - TLSH:
T1564BE057AAF28680C8D88CD19451923C49D863B1B1AD2BB67C9D3B3FD47A007AC711ED - Submitted as: virussign.com_e6f0e6fd4e1b011a6e3de8f97fd2c470.vir
- File type: pe · Size: 512000 bytes
- Verdict: malicious (99/100) · Family: Virlock
Source: VirusSign · first seen 2026-07-23T00:00:00.000Z · SHA-256 verified
Detections (6 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Virus.Virlock-6804475-0
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Win32.Virlock.Gen.1
- Kaspersky (KVRT): Virus.Win32.PolyRansom.b
- Trellix Stinger (McAfee): W32/VirRansom.b
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Virus.Virlock-6804475-0 (rule
Win.Virus.Virlock-6804475-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7256) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged flagged (rule
flagged) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.1 (rule
Win32.Virlock.Gen.1) - engine signal, weight 0.55, confidence 0.85 - Extracted VirLock config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Extracted VirLock config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
243 behavior events · 1 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- searchapp.bundleassets.example
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- desktop-hsgcbep
- config.edge.skype.com
- www.bing.com
- fd.api.iris.microsoft.com
- aps.prod.windows.com
- dns.msftncsi.com
- tas02.sls.update.microsoft.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- teams.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- 224.0.0.252
- 192.168.122.1
Dropped files
- /opt/CAPEv2/storage/analyses/3018/files/fffb9eb9d0a10da5ae91bb5f863161bdd2c041d8974b48297dc360658fc104f3 -
fffb9eb9d0a10da5ae91bb5f863161bdd2c041d8974b48297dc360658fc104f3 - /opt/CAPEv2/storage/analyses/3018/files/67c78a31af3a24d6da9651deafc99716ef9c2c2a526bfd460cb26b48d733980c -
67c78a31af3a24d6da9651deafc99716ef9c2c2a526bfd460cb26b48d733980c - a2350e29a548a91234c16501fe1a6558bb3db7b96921f8c723f8c29c44348bdd -
a2350e29a548a91234c16501fe1a6558bb3db7b96921f8c723f8c29c44348bdd
Embedded domains
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- www.msftconnecttest.com
- searchapp.bundleassets.example
- config.edge.skype.com
- www.bing.com
- fd.api.iris.microsoft.com
- aps.prod.windows.com
- dns.msftncsi.com
- tas02.sls.update.microsoft.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- teams.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
More Virlock samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report