MALICIOUS — virussign.com_73c24a195a7d951172f6a996de3989d0.vir

MALICIOUS — virussign.com_73c24a195a7d951172f6a996de3989d0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mydoom family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b0f16b37a7892416ad9a2eb1b8087a1279226bde2ef701406f609b1ce27f2232
SHA-1: 0eb145ff129b245192916e6c4ed4491cb15c2f46
MD5: 73c24a195a7d951172f6a996de3989d0
imphash: 355a11bb33034aa9b09fce9bd5853c63
ssdeep: 768:j07c92/EyTAYtxqfGNC0klI7C8ycYlI5P194jp4Rzis2NRGn:g7wc1aGNC0klI7CPpIFa6kswGn
TLSH: T1CE338EA29F12EE44C7A57A308CC0BDAC9251FC9E847A0DADC3E0D1EDC5F18979191729
Submitted as: virussign.com_73c24a195a7d951172f6a996de3989d0.vir
File type: pe · Size: 48132 bytes
Verdict: malicious (100/100) · Family: Mydoom

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Worm.Mydoom-7
Microsoft Defender: Trojan:Win32/Malex!atmnm
Emsisoft (Emergency Kit): Win32.Mydoom.L@mm
Trellix Stinger (McAfee): W32/Mydoom.c.n@MM
Kaspersky (KVRT): Email-Worm.Win32.Mydoom.l

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Worm.Mydoom-7 (rule Win.Worm.Mydoom-7) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Malex!atmnm (rule Trojan:Win32/Malex!atmnm) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Mydoom.L@mm (rule Win32.Mydoom.L@mm) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Mydoom.c.n@MM (rule W32/Mydoom.c.n@MM) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Email-Worm.Win32.Mydoom.l (rule Email-Worm.Win32.Mydoom.l) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 7 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

998 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\p8dE.txt - b08eab63f028bd8c0be00ebd5e794ce1561c5a685a646d887023d2ad6a0d3086

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

sf.net
yahoo.com

Embedded IP addresses

52.178.17.2
4.144.132.114
52.123.252.248
4.230.171.124
20.165.94.54
20.42.179.204
20.184.175.22
20.165.94.63
104.18.33.89
15.80.67.196
66.189.26.89
52.110.12.3
129.204.109.22
188.199.3.251
188.199.3.191
16.80.195.125
57.155.101.212
20.89.1.8
72.145.35.103
52.148.114.188
52.110.12.20
52.110.12.48

More Mydoom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report