MALICIOUS — virussign.com_4838ddf90d579b561d840487ca37b970.vir

MALICIOUS — virussign.com_4838ddf90d579b561d840487ca37b970.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the AntiDebug family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c5df5058508f90954d1d570fc5091cd54da9ee3e59a4898cbc5ec4f3299f8ee8
SHA-1: 39a326e7827b39007b94d075ad659a26959444de
MD5: 4838ddf90d579b561d840487ca37b970
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 196608:h9Fp3AnmCA1SE7xtLIuniAborEXiHAKfJ458UD:3XAnmlHNJrnpkoD584
TLSH: T1B86922A2000761B2D5F7CD5AA42E85ED8063F05895728B6F9007E41E429C3BFF7F68A5
Submitted as: virussign.com_4838ddf90d579b561d840487ca37b970.vir
File type: pe · Size: 8532992 bytes
Verdict: malicious (97/100) · Family: AntiDebug

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text,.datawcp,.rdataiz,.tlsjcyb
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.GenericKDZ.119183
Kaspersky (KVRT): HEUR:Trojan.Win64.Convagent.gen

MITRE ATT&CK

T1057

Why this verdict

The malicious score of 97/100 is the fusion of 10 weighted signals:

Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.119183 (rule Trojan.GenericKDZ.119183) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Convagent.gen (rule HEUR:Trojan.Win64.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text,.datawcp,.rdataiz,.tlsjcyb (rule high-entropy-sections:.text,.datawcp,.rdataiz,.tlsjcyb) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text,.datawcp,.rdataiz,.tlsjcyb - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

877 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

7be28f288f86663b17607ae7f9bf0def2dbd3620a04c8587ff6f258c174cb2cc - 7be28f288f86663b17607ae7f9bf0def2dbd3620a04c8587ff6f258c174cb2cc
7adbd08ce55fa06c092ca4e1855445c5abf1594e4dc673e21509b11160421017 - 7adbd08ce55fa06c092ca4e1855445c5abf1594e4dc673e21509b11160421017

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

e.uk
h.mx
hx.gq
bsb.us

Embedded IP addresses

20.42.65.93
20.247.185.124
4.230.171.124
135.232.92.97
52.168.117.170
172.215.188.232
74.179.77.204
172.64.154.167
4.247.188.233
52.110.12.2
52.110.12.11

File paths

y:\E

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report