MALICIOUS — virussign.com_96a6d414fcbbf164a51956dbc83c63c0.vir

MALICIOUS — virussign.com_96a6d414fcbbf164a51956dbc83c63c0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Expiro family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: a91d8b94cbc5cb9d79b3edea36abc64d5324b6786d225679320decbc73b7de72
• SHA-1: 721ce39cb03e3143f916a0855d706d61916e0829
• MD5: 96a6d414fcbbf164a51956dbc83c63c0
• imphash: 2426805ad79dbcdbbb413d839740da1f
• ssdeep: 49152:HoLtBa7F4amnNZZMcDlyVQ8VXvmA1wxVriAY8Eic/QyZ/yFv33yneO4ijbPgxim:InWEVjvzF/lijrgNrr+Lr+GLm
• TLSH: T14F625CD08713A133F472D648AC4186ECC032BC6C6173EDA99783EE7994D9537D8EA192
• Submitted as: virussign.com_96a6d414fcbbf164a51956dbc83c63c0.vir
• File type: pe · Size: 4296192 bytes
• Verdict: malicious (96/100) · Family: Expiro

Source: VirusSign · first seen 2026-08-05T00:00:00.000Z · SHA-256 verified

Detections (8 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Virus.Expiro-9970350-0
• YARA: Trellix/McAfee ATR: ATR_LockBit_Ransomware
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Virus:Win32/Expiro.HNW!MTB
• Emsisoft (Emergency Kit): Win64.Expiro.Gen.7
• Trellix Stinger (McAfee): W32/Expiro.gen.re
• Kaspersky (KVRT): Virus.Win64.Moiva.a

MITRE ATT&CK

• T1056.001

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Virus.Expiro-9970350-0 (rule Win.Virus.Expiro-9970350-0) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: Trellix/McAfee ATR flagged ATR_LockBit_Ransomware (rule ATR_LockBit_Ransomware) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.devicescape.com/tos, http://www.devicescape.com/privacy - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.devicescape.com/tos
• http://www.devicescape.com/privacy

Embedded domains

• schemas.microsoft.com
• co.cf
• p.us
• www.devicescape.com

File paths

• C:\Program
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
• D:\jkp\workspace\MUROC\2266\MUROC4481\Source\WSS_WiFi\WiFi_Muroc\CPAppletExe\x64\Release\CPAppletExe.pdb

More Expiro samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report