MALICIOUS — virussign.com_cd071c4e8e48171b1b42e95a7eadec40.vir

MALICIOUS — virussign.com_cd071c4e8e48171b1b42e95a7eadec40.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Sality family. 5 of 51 detection engines flagged it.

Identification

• SHA-256: ca3d8814ce8cd95a9f9b9631731673b6c18a882eafdf0d384fe796a54cd6b0b4
• SHA-1: 111633c1c2ddae8c913e1f6b2a4a2c73118896fd
• MD5: cd071c4e8e48171b1b42e95a7eadec40
• imphash: de8b7e508ea4346913fa27a6b3f5d695
• ssdeep: 1536:pz+obIePjzz/gyCIUZt5bzTVcGzaQfI53PcJwCReXqmn/k2LZSuPX8aqPN:pz+DePj3CIURNcGzG53CwTa8c2Tv8aqF
• TLSH: T1BD37D0A94AACA66FDAA1E0142C55F08D80F3E4C025F7DE1C16D46D21D0CB6DBD8607AF
• Submitted as: virussign.com_cd071c4e8e48171b1b42e95a7eadec40.vir
• File type: pe · Size: 73887 bytes
• Verdict: malicious (90/100) · Family: Sality

Source: VirusSign · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (5 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:3
• ClamAV (daily): Win.Trojan.Sality-1011
• Microsoft Defender: Virus:Win32/Sality.D
• Emsisoft (Emergency Kit): Win32.Sality.D
• Kaspersky (KVRT): Virus.Win32.Sality.d

Why this verdict

The malicious score of 90/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Sality-1011 (rule Win.Trojan.Sality-1011) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://gnuwin32.sourceforge.net, http://www.darwinsys.com/file/ - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: high-entropy-sections:3 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://gnuwin32.sourceforge.net
• http://www.darwinsys.com/file/

Embedded domains

• gnuwin32.sourceforge.net
• www.darwinsys.com

More Sality samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report