MALICIOUS — virussign.com_b6571d2b0f9f26f23ff0e578290cef70.vir

MALICIOUS — virussign.com_b6571d2b0f9f26f23ff0e578290cef70.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Guap family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: c7f2cc44586a67faac0e2df97ffdf42c4604c16f4649bf36c81566b94279ee6d
• SHA-1: 863f28a23f6afb7fb6a8f7fc9f0cdaafa30cf2ad
• MD5: b6571d2b0f9f26f23ff0e578290cef70
• imphash: b6230692891661869cecd581561a21f4
• ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXo:zW6ncoyqOp6IsTl/mXo
• TLSH: T1A64CBEC8BAC7DD54E8E97B86E45544BDD68BD12F186D2E8F0392C2386F812F3A471112
• Submitted as: virussign.com_b6571d2b0f9f26f23ff0e578290cef70.vir
• File type: pe · Size: 533261 bytes
• Verdict: malicious (94/100) · Family: Guap

Source: VirusSign · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• ClamAV (daily): Win.Worm.Guap-4
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
• Microsoft Defender: Trojan:Win32/Fsysna!pz
• Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded domains

• server.com
• tsymantec.com
• tsecurityresponse.symantec.com
• tsarc.com
• twww.sarc.com
• twww.sophos.com
• tsophos.com
• twww.mcafee.com
• tmcafee.com
• tliveupdate.symantecliveupdate.com
• twww.viruslist.com
• tviruslist.com
• tf-secure.com
• twww.f-secure.com
• tf-prot.com
• twww.f-prot.com
• tkaspersky.com
• tkaspersky-labs.com
• twww.avp.com
• tavp.com
• twww.kaspersky.com
• twww.networkassociates.com
• tnetworkassociates.com
• twww.ca.com
• tca.com

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• C:\Program
• C:\WINDOWS\system32\drivers\etc\hosts

More Guap samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report