MALICIOUS — virussign.com_836500af39bed33d20929ec20f39a8b0.vir
MALICIOUS — virussign.com_836500af39bed33d20929ec20f39a8b0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Azov family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
c6ae45622bd50f221d3bd55e80cf654513a94a29926e83ef0eac7dc547530005 - SHA-1:
b521de6dd9580ea8bd263089d329ae34a0ebe91e - MD5:
836500af39bed33d20929ec20f39a8b0 - imphash:
192025aad4af5c51ace94c8c489e08de - ssdeep:
49152:j+E9+Eg+ES+E2+ESM+ES+ETqatglu+ES+Eg+ES+E2+ESM+ES+ETqatglC+ESM+E5:7sSsBsSsIW1q - TLSH:
T146683A525259630ADEF0D565DC0C8E2E614379AAB2786FDCA297D60841DBCF3803D0EB - Submitted as: virussign.com_836500af39bed33d20929ec20f39a8b0.vir
- File type: pe · Size: 7906894 bytes
- Verdict: malicious (98/100) · Family: Azov
Source: VirusSign · first seen 2026-08-14T00:00:00.000Z · SHA-256 verified
Detections (6 of 52 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- ClamAV (daily): Win.Ransomware.Azov-10044441-0
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_Emotet
- YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
- Microsoft Defender: Trojan:Win32/Rozena.ALR!MTB
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Ransomware.Azov-10044441-0 (rule
Win.Ransomware.Azov-10044441-0) - engine signal, weight 0.90, confidence 0.95 - Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_Emotet (rule
JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule
TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - inject code into another process (rule
inject code into another process) - capa signal, weight 0.12, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/windows0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- 6f051164.abortpxe.com
- d47438d.abortpxe.com
- 2abe3961.abortpxe.com
- 674e409d.abortpxe.com
- 42434f53.abortpxe.com
- 1cdbc72.abortpxe.com
- 4e20370b.abortpxe.com
- 2ae72b55.abortpxe.com
- www.microsoft.com
- crl.microsoft.com
- 635766c2.hdlscom2.com
- 6581370c.hdlscom2.com
- 153a1385.hdlscom2.com
- 487b56eb.hdlscom2.com
Embedded IP addresses
- 104.208.16.94
- 52.253.84.76
- 4.230.171.124
- 4.247.188.224
- 20.165.94.63
- 4.150.223.115
- 74.178.240.51
- 74.178.240.61
- 72.153.5.96
- 4.150.223.108
- 52.148.114.188
- 52.123.129.14
- 74.179.71.159
- 20.236.44.162
- 52.110.12.37
- 52.110.12.18
File paths
- c:\windows
- c:\program
- c:\users\administrator\desktop\mingw32
More Azov samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report