MALICIOUS — virussign.com_dd5e4eccdf49095e94067291a804c4a0.vir

MALICIOUS — virussign.com_dd5e4eccdf49095e94067291a804c4a0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the execute family. 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b629f4c79e366a1e3f0b63d6e8b9e3401bb7367fa88f83b28c06f702a952b761
SHA-1: 0f0bcccd96b200b1cd552ee2c0d75100d5dc3d5a
MD5: dd5e4eccdf49095e94067291a804c4a0
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 3072:g8qdFgrGxYLGM9V+ToW9Y/+EXkPIPnS8kg:gJFoVMoW97Gj
TLSH: T1233E5C86A8442338E8718D16747ED2DE3FA51C55CB6E7ADC1A089D71609CE3B3A3D10B
Submitted as: virussign.com_dd5e4eccdf49095e94067291a804c4a0.vir
File type: pe · Size: 140800 bytes
Verdict: malicious (94/100) · Family: execute

Source: VirusSign · first seen 2026-07-17T00:00:00.000Z · SHA-256 verified

Detections (3 of 53 engines)

capa (capabilities): execute via PowerShell
Microsoft Defender: Trojan:Win32/Yomal!rfn
Emsisoft (Emergency Kit): Gen:Variant.Adware.MSILHeracles.932

MITRE ATT&CK

Why this verdict

The malicious score of 94/100 is the fusion of 7 weighted signals:

Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7496) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Yomal!rfn (rule Trojan:Win32/Yomal!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.MSILHeracles.932 (rule Gen:Variant.Adware.MSILHeracles.932) - engine signal, weight 0.55, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Embedded network infrastructure: https://lki.tax.nalog.ru/tech/, https://lki.tax.nalog.ru/include/ajax_techaction.php?action=Execution, https://lki.tax.nalog.ru/tech/new.php - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2277 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3600/files/94c743a1ee48d2c24c5ff0cbae3618760c9f651a5599541653038481c2d8cb50 - 94c743a1ee48d2c24c5ff0cbae3618760c9f651a5599541653038481c2d8cb50
c94c0d33f48241431509d9a6843efb5c4d5bb4baba0d9e6ad215feb879626ad9 - c94c0d33f48241431509d9a6843efb5c4d5bb4baba0d9e6ad215feb879626ad9
7bc0555d3bcdb9a86d16b679518419b6a506ffb430632b1e3473e495856d9a34 - 7bc0555d3bcdb9a86d16b679518419b6a506ffb430632b1e3473e495856d9a34

Embedded URLs

https://lki.tax.nalog.ru/tech/
https://lki.tax.nalog.ru/include/ajax_techaction.php?action=Execution
https://lki.tax.nalog.ru/tech/new.php
https://lki.tax.nalog.ru/include/ajax_techaction.php

Embedded domains

lki.tax.nalog.ru
staging.to-do.officeppe.com
searchapp.bundleassets.example
www.msftconnecttest.com
config.edge.skype.com
www.bing.com
to-do.microsoft.com
ctldl.windowsupdate.com
settings-win.data.microsoft.com
dns.msftncsi.com
staging.to-do.microsoft.com
edge.microsoft.com
watson.events.data.microsoft.com
aps.prod.windows.com
teams.microsoft.com
ecs.office.com
g.live.com
self.events.data.microsoft.com
www.msftncsi.com
fs.microsoft.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com

File paths

C:\Windows\Media\Windows
C:\Windows\Media\notify.wav
C:\Windows\Media\tada.wav

More execute samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report