MALICIOUS — virussign.com_657a200f76d10f4703355e3db310f350.vir
MALICIOUS — virussign.com_657a200f76d10f4703355e3db310f350.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Somhoveran family. 6 of 52 detection engines flagged it.
Identification
- SHA-256:
d03eecc1156d35d3d72dfc5971e18f52bec86cb2f97089a39de5ec56aba73b9c - SHA-1:
58779d3014d152cccda00e43ecc3429d0651085a - MD5:
657a200f76d10f4703355e3db310f350 - imphash:
e60d0e6577962a1096407913ed128742 - ssdeep:
6144:Nh9wv1Uveh9wv1UXxSfLG3YPIxVjpYTZBLbi:Nh9wt4eh9wtMxSDGr9w7i - TLSH:
T1A1431206F5CA403CEAE776B92CD8A6ADF464475C00326DC07E4626C7951CB67A8B4ACC - Submitted as: virussign.com_657a200f76d10f4703355e3db310f350.vir
- File type: pe · Size: 221184 bytes
- Verdict: malicious (91/100) · Family: Somhoveran
Source: VirusSign · first seen 2026-08-10T00:00:00.000Z · SHA-256 verified
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
- Detect It Easy (packer/type): DIE:Turbo Linker
- Microsoft Defender: Trojan:Win32/Vindor!pz
- Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.nmJfa4pdRVd
- Kaspersky (KVRT): Worm.Win32.Wenper.b
Why this verdict
The malicious score of 91/100 is the fusion of 3 weighted signals:
- ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule
Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95 - Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule
DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded domains
- y.ai
More Somhoveran samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report