MALICIOUS — virussign.com_22e65e83124038a1a22249026dbcee80.vir
MALICIOUS — virussign.com_22e65e83124038a1a22249026dbcee80.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Razy family. 6 of 55 detection engines flagged it.
Identification
- SHA-256:
cf1088a123d857c269b99134c5adbd5497919a2c41733195d6e011d5726cd44e - SHA-1:
976c324b59898c78a1bc998d8a2b66899d219561 - MD5:
22e65e83124038a1a22249026dbcee80 - imphash:
de2248544d046fec2c88fd680f3ade3e - ssdeep:
1536:DOyyrJMAZiIyo09bEz/0cg+aHcsNoBoAxin8dUEgiFkSIgiItKq9v6Ds:yXutRWGgxinWUEgixtBtKq9vn - TLSH:
T1EF386C03B7252290CDF2D29A9C56BE3CDCA0317F64BC1C7082B5D088DC6569B744BE9A - Submitted as: virussign.com_22e65e83124038a1a22249026dbcee80.vir
- File type: pe · Size: 81448 bytes
- Verdict: malicious (87/100) · Family: Razy
Source: VirusSign · first seen 2026-08-16T00:00:00.000Z · SHA-256 verified
Detections (6 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Trojan.Razy-10016933-0
- Microsoft Defender: Backdoor:Win32/Berbew.AA!MTB
- Emsisoft (Emergency Kit): Dropped:Backdoor.Padodor.BJ
- Trellix Stinger (McAfee): Trojan-FVOJ!22E65E831240
- Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.gen
Why this verdict
The malicious score of 87/100 is the fusion of 2 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Razy-10016933-0 (rule
Win.Trojan.Razy-10016933-0) - engine signal, weight 0.90, confidence 0.95 - Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.oracle.com/education/oln
- http://oracle.com/contracts
Embedded domains
- adr.org
- www.oracle.com
- microsoft.com
- oracle.com
More Razy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report