MALICIOUS — virussign.com_1e439b45cfb8e0e98507346b34d2aad0.vir

MALICIOUS — virussign.com_1e439b45cfb8e0e98507346b34d2aad0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Reactor family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c1943142cce1f4b598fdb5171159e43b45b9dfe00cab9598e6f15bb422c7a011
SHA-1: 260c95c5bbc4ff0e68c7d12b7020cb2c6f351e57
MD5: 1e439b45cfb8e0e98507346b34d2aad0
imphash: 88016fcdef7f227c62171d0afad9aae4
ssdeep: 49152:vuI5heXc1DYJjNU3id/fPilfX/Dr8iuqjjJ:v5/QcpGNUw/fPi5rQSJ
TLSH: T11B5AAE8A7F1B7622C769D7201160BA7F08F3AC4F077F5A4801A5AB1E96F481715E138B
Submitted as: virussign.com_1e439b45cfb8e0e98507346b34d2aad0.vir
File type: pe · Size: 2130792 bytes
Verdict: malicious (95/100) · Family: Reactor

Source: VirusSign · first seen 2026-07-05T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

capa (capabilities): beacon to command-and-control
MalwareAnalyser heuristics (entropy/packer): .NET Reactor 2.X-3.X
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:.NET Reactor 2.X-3.X
Kaspersky (KVRT): not-a-virus:HEUR:Downloader.Win32.Softonic.gen

MITRE ATT&CK

Why this verdict

The malicious score of 95/100 is the fusion of 10 weighted signals:

Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8100) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:.NET Reactor 2.X-3.X (rule DIE:.NET Reactor 2.X-3.X) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline, 4.0.2.0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: .NET Reactor 2.X-3.X - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6284 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/1912/files/ad44ccbfc69fda66fef3c812fe4aab5eafaf8bd654f8b707081c30233677544a - ad44ccbfc69fda66fef3c812fe4aab5eafaf8bd654f8b707081c30233677544a
e6b1608852d80003152dc655e1b339590ffff1b48436ede1b64b99a53597c888 - e6b1608852d80003152dc655e1b339590ffff1b48436ede1b64b99a53597c888
3402c54475803de6b7d57992dc1854d0314baaf231a23cfc319d883d60f7f136 - 3402c54475803de6b7d57992dc1854d0314baaf231a23cfc319d883d60f7f136

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
https://sectigo.com/CPS0
http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl05
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
https://jrsoftware.org/ishelp/index.php?topic=setupcmdline

Embedded domains

schemas.microsoft.com
mj.pw
crl.comodoca.com
crl.sectigo.com
crt.sectigo.com
sectigo.com
crl.usertrust.com
jrsoftware.org
searchapp.bundleassets.example
www.msftconnecttest.com
edge-consumer-static.azureedge.net
config.edge.skype.com
dns.msftncsi.com
www.bing.com
edge.microsoft.com
msedge.api.cdp.microsoft.com
ecs.office.com
g.live.com
self.events.data.microsoft.com
fs.microsoft.com
www.msftncsi.com
geo.prod.do.dsp.mp.microsoft.com
aps.prod.windows.com

Embedded IP addresses

4.0.2.0

File paths

T:\:d:l:p:t:x:
X:\:`:d:h:l:p:t:x:
N:\:k:
E:\:
X:\:`:h:p:x:
U:\:c:j:t:
T:\:j:x:
T:\:d:l:t:
D:\Coding\Is\issrc-build\Components\ChaCha20.pas
x:\dirname

More Reactor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report