MALICIOUS — virussign.com_97deb79bdbb98435a59cf8cfda899450.vir

MALICIOUS — virussign.com_97deb79bdbb98435a59cf8cfda899450.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Dphe family. 6 of 52 detection engines flagged it.

Identification

• SHA-256: c6a00e195f9e58128b800d2f4d809bb4371e2c419157c83516fd95cf07fae906
• SHA-1: 647dc2c2fda4bd430ad20304a83ba9cd7bd04f95
• MD5: 97deb79bdbb98435a59cf8cfda899450
• imphash: ecb74ec087230d17dc74d7cde47aa732
• ssdeep: 12288:WA6mlfQ2rpk8k1/FomGv68UCYkhzUnJkk9:XLl7k/B2mGbUMoJZ
• TLSH: T1CD4EF17642E39025D5BA3B216843A4AC85336E2D4265394B4E03D8ED5DBBDD7C8F3093
• Submitted as: virussign.com_97deb79bdbb98435a59cf8cfda899450.vir
• File type: pe · Size: 643428 bytes
• Verdict: malicious (91/100) · Family: Dphe

Source: VirusSign · first seen 2026-08-12T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Dphe-10058394-0
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: BrowserModifier:Win32/Diplugem
• Emsisoft (Emergency Kit): Trojan.Agent.DPHE
• Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.gen

Why this verdict

The malicious score of 91/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Malware.Dphe-10058394-0 (rule Win.Malware.Dphe-10058394-0) - engine signal, weight 0.90, confidence 0.95
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• u.su

More Dphe samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report