MALICIOUS — virussign.com_4159e378b4bb65427d63f0a013e81770.vir

MALICIOUS — virussign.com_4159e378b4bb65427d63f0a013e81770.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 5 of 55 detection engines flagged it.

Identification

SHA-256: a40c76bf933e682af8639282a319eb34368af8df7821bf0c919a558b1808b243
SHA-1: ceef5a169684ecf9798bcc21029d944fbd474a56
MD5: 4159e378b4bb65427d63f0a013e81770
imphash: cdad71f00be06ad1b130e995c45f78b1
ssdeep: 3072:z0G0oYZ1TI08Un7/EPbJerfhJKayZxhvn/H4O6zuGHbXVVInbHlx:z0Nox5UnoP9erfM7YoGHTvInb
TLSH: T1DA4BD8AE6A9746EFC31B37416E9014CC13D206CAD1878C66E009C685A7F17F7B98C5E1
Submitted as: virussign.com_4159e378b4bb65427d63f0a013e81770.vir
File type: pe · Size: 479246 bytes
Verdict: malicious (93/100)

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Packed.Generic-9967832-0
Microsoft Defender: Trojan:Win32/Fareit.VB!MTB
Trellix Stinger (McAfee): Trojan-JBCL!4159E378B4BB
Kaspersky (KVRT): Trojan.Win32.VB.dosq

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9967832-0 (rule Win.Packed.Generic-9967832-0) - engine signal, weight 0.90, confidence 0.95
Contacted 28 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

20580 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/photoshop/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/xap/1.0/sType/Resou
http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850954&P2=404&P3=2&P4=jt9RGtOQ7AnhoHtEBBXTJ9nKSXSBg6oShZwIpIwQ3uIrqCfQJNyGYzw5Sc%2b0X%2bPwdb0zNK4%2fCj7gv%2bIpWKeTuA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787851001&P2=404&P3=2&P4=RkgfUJGmKCkcF7%2bY0N6RGfBAykXIsL6ptpwMsq1Zw93%2fL9PB03RALDj7lU2e%2fxgGTG5vA1u8fwsX9y08g%2fZBqA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns.adobe.com
www.w3.org
purl.org
www.iec.ch

Embedded IP addresses

52.123.252.204
13.89.179.15
4.230.171.124
20.42.179.204
20.247.184.197
52.123.252.229
74.178.76.128
52.182.141.63
135.232.92.97
74.178.240.61
20.112.250.133
52.123.252.242
40.103.64.226
40.99.134.18
52.123.128.14
52.168.112.66
203.26.79.13
57.155.104.224
135.234.160.246
135.232.92.34
52.123.252.226
40.79.150.123
52.148.114.188
72.154.7.112
52.123.252.243

File paths

C:\Program

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report