MALICIOUS — virussign.com_fce7e8fb93b0e25eb5525e309aafe250.vir

MALICIOUS — virussign.com_fce7e8fb93b0e25eb5525e309aafe250.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Azov family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: cf33d4252e286d1dfc40d00040b61c01d65f2fe850f6f6df66160b38b4cf2fdd
SHA-1: 9a468d541f9dd5023ad08a3e81abf3a7f52e6290
MD5: fce7e8fb93b0e25eb5525e309aafe250
imphash: 0f4f0c3e62a9e9cfa3fe2208af74764a
ssdeep: 12288:tJLspSYnEv2GvPuYNs9W0mKPrGlrL64UbWC5hR/4sb456:/IpFnEvTuYcbPrGlrmHbp0M456
TLSH: T18D4E48C1D887A487C399D918D4A198DC883DF065F4B1C0A84A52D2A9DAFDD3371FB24B
Submitted as: virussign.com_fce7e8fb93b0e25eb5525e309aafe250.vir
File type: pe · Size: 653277 bytes
Verdict: malicious (91/100) · Family: Azov

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:credential-access
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!FCE7E8FB93B0
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 91/100 is the fusion of 9 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 19 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

36f89ce17627b9ed7338555ec09a64b4b0369315759976443a20d169748985c1 - 36f89ce17627b9ed7338555ec09a64b4b0369315759976443a20d169748985c1

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787741269&P2=404&P3=2&P4=cXuszNhAU8zkRY%2bhUkqKodDkHNNmk9a4dTn%2fTJlCO9HY3XII%2f4nSc7XLnM6o8WUVskH09idmYYRfyfLOFvk7Nw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

203.26.79.13
4.247.188.233
20.184.175.11
52.123.252.234
57.155.104.224
4.230.171.124
4.144.132.223
74.178.240.61
20.184.175.21
74.178.240.51
13.89.179.15
52.123.129.14
20.76.201.171
40.99.133.210
135.233.45.223
72.153.5.60
20.165.94.46
52.148.114.188
52.110.12.47

More Azov samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report