SUSPICIOUS — virussign.com_f2e994f3b0004eb027bc71c41b2443f0.vir

SUSPICIOUS — virussign.com_f2e994f3b0004eb027bc71c41b2443f0.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 1 of 50 detection engines flagged it.

Identification

SHA-256: b59572bb6ea35faa029f3e6d83439ca9a7573ede61c0fe32682db7f60622bbbd
SHA-1: 5c5c8b3c3d0e9da3ddad70248481788f57da4994
MD5: f2e994f3b0004eb027bc71c41b2443f0
ssdeep: 384:ZIakiuS73YF3VpNJ/FssDYJ3Y5uSkrXEq7Bwpd9dmbzO:CS7s5ssDa3Y5xpd2W
TLSH: T1DE271B3B318C4F5E844456D9FCDCB87836E2A18AA57424F849EBDED5C89CD34AE19820
Submitted as: virussign.com_f2e994f3b0004eb027bc71c41b2443f0.vir
File type: html · Size: 16341 bytes
Verdict: suspicious (54/100)

Source: VirusSign · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (1 of 50 engines)

Microsoft Defender: Trojan:HTML/Phish.AO!atmn

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

Obfuscated javascript script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Embedded network infrastructure: https://yfdnzf.com/?dn=ask-lex.fr&pid=9PO755G95&_nozc_=1, https://euob.northwavepoint.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.js, https://obseu.northwavepoint.com/ns/636f8b858f681acb7bfa6f583a96630a.html?ch=AdsDeli%20-%20iFrame - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://yfdnzf.com/?dn=ask-lex.fr&pid=9PO755G95&_nozc_=1
https://euob.northwavepoint.com/sxp/i/636f8b858f681acb7bfa6f583a96630a.js
https://obseu.northwavepoint.com/ns/636f8b858f681acb7bfa6f583a96630a.html?ch=AdsDeli%20-%20iFrame

Embedded domains

ask-lex.fr
yfdnzf.com
n.link
e.link
euob.northwavepoint.com
obseu.northwavepoint.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report