MALICIOUS — virussign.com_da3749f1954d79d4e171c2ae97a544b0.vir

MALICIOUS — virussign.com_da3749f1954d79d4e171c2ae97a544b0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the Maldoc family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: b7880fed8d8b14641e6308760b2bc19782fa0b230a0a3ba5eedf14114c03a0f8
SHA-1: e17754d45093c4bcc07282fb9db0f702989c7b3c
MD5: da3749f1954d79d4e171c2ae97a544b0
imphash: 0f4f0c3e62a9e9cfa3fe2208af74764a
ssdeep: 12288:tJLspSYnEv2Gv8uYjs900HuIRYitjGXe3Ij:/IpFnEvQuYgOIRYitjnYj
TLSH: T10D4E4AC1D887A587C3ACD918D4A198DC883DF065F4B1C0A84692D1A69EFDD3371BB24B
Submitted as: virussign.com_da3749f1954d79d4e171c2ae97a544b0.vir
File type: pe · Size: 653277 bytes
Verdict: malicious (82/100) · Family: Maldoc

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:credential-access
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!DA3749F1954D
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 82/100 is the fusion of 8 weighted signals:

access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

7d0a03f7d41094625e4de84f761f3c0b78c8acdd9133fc5cb707b45ab9cf8486 - 7d0a03f7d41094625e4de84f761f3c0b78c8acdd9133fc5cb707b45ab9cf8486

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787936778&P2=404&P3=2&P4=UwYgXxPIlYj6tFCdI%2bkZxA113cCHXAQnQLhssUWF%2baFcDWoLxBil4dKCSTOfuQSjxEGw%2bQGlhiLBA2pfG8xqfw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

52.168.112.67
20.42.179.204
4.230.171.124
20.165.94.63
4.144.132.114
20.165.94.54
13.89.179.15
20.50.201.195
52.123.129.14
20.112.250.133
52.123.128.14
40.99.134.18
162.159.142.9
203.26.79.13
135.233.45.221
92.223.78.30
52.123.252.197
52.123.252.232
172.178.240.162
74.178.76.44
52.148.114.188
52.110.12.30
52.110.12.8
72.153.5.131

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report