MALICIOUS — virussign.com_af6394117159a24adebd284eeef58c40.vir

MALICIOUS — virussign.com_af6394117159a24adebd284eeef58c40.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Pvpk family. 5 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: acc5fd79b0cbd864fe085ad8cfbc8ea705e6f277f14d7cfddc7864564acee932
• SHA-1: 5f8481a3264b358a0619ed8f438f38a19a18ef11
• MD5: af6394117159a24adebd284eeef58c40
• imphash: e780223af31e5cc3f52e2ebb06482260
• ssdeep: 24576:2ziS+eOKJSR1JvuuU1FrY66PHgG2Fy8+LlgpaFeYSsEahpntsYEXdEGqM4rPrx/M:oiSafC6YG2Y8SlPF70OpudgrjVw
• TLSH: T11E593312A765BF98F0971C33E72E4F8E158A38F558E12305267986783DD056F1B93232
• Submitted as: virussign.com_af6394117159a24adebd284eeef58c40.vir
• File type: pe · Size: 1804492 bytes
• Verdict: malicious (97/100) · Family: Pvpk

Source: VirusSign · first seen 2026-07-30T00:00:00.000Z · SHA-256 verified

Detections (5 of 52 engines)

• ClamAV (daily): Win.Malware.Pvpk-10056926-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Worm:Win32/Sfone!pz
• Emsisoft (Emergency Kit): Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
• Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

• T1057

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Malware.Pvpk-10056926-0 (rule Win.Malware.Pvpk-10056926-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Worm:Win32/Sfone!pz (rule Worm:Win32/Sfone!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Dropped:Generic.Malware.PVPk!!prn!.FE0B916D (rule Dropped:Generic.Malware.PVPk!!prn!.FE0B916D) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• 7.cf

File paths

• E:\.0S

More Pvpk samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report