MALICIOUS — virussign.com_92fce420015db9108aa2684f9c89e8e0.vir

MALICIOUS — virussign.com_92fce420015db9108aa2684f9c89e8e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the PyInstaller family. 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d16505fa275fc5bbce817d8531d7f17f9ec68f4cbbe7fae07ecba084bb7df8e2
SHA-1: 723a0bd736c9ed43bc8fd8fe94fc32a5907ef198
MD5: 92fce420015db9108aa2684f9c89e8e0
imphash: 351592d5ead6df0859b0cc0056827c95
ssdeep: 196608:JeRsCtonIXYvXMCHGLLc54i1wN+KV0cSXl74w41CT+qM881Zl16:ERGNvXMCHWUjyVg74wnMR6
TLSH: T1D468336E16175451ECE0E938FCA88C6CD4A3F4B9663AE648DE03DC5D74E193388F1982
Submitted as: virussign.com_92fce420015db9108aa2684f9c89e8e0.vir
File type: pe · Size: 8063433 bytes
Verdict: malicious (84/100) · Family: PyInstaller

Source: VirusSign · first seen 2026-07-16T00:00:00.000Z · SHA-256 verified

Detections (3 of 53 engines)

capa (capabilities): beacon to command-and-control
MalwareAnalyser heuristics (entropy/packer): PyInstaller
Detect It Easy (packer/type): DIE:PyInstaller

MITRE ATT&CK

Why this verdict

The malicious score of 84/100 is the fusion of 6 weighted signals:

Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7224) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
Detect It Easy (packer/type) flagged DIE:PyInstaller (rule DIE:PyInstaller) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PyInstaller - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2526 behavior events · 1 ATT&CK techniques · 49 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3514/files/637e9a34044c366b9b004e62ee15aa4875e344a5a6b7634c803a40d95883d7cc - 637e9a34044c366b9b004e62ee15aa4875e344a5a6b7634c803a40d95883d7cc
/opt/CAPEv2/storage/analyses/3514/files/44705d9b3271d9db307f92c7c2764a98db5819e670897dbfc95beb386a1840bb - 44705d9b3271d9db307f92c7c2764a98db5819e670897dbfc95beb386a1840bb
/opt/CAPEv2/storage/analyses/3514/files/14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148 - 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
/opt/CAPEv2/storage/analyses/3514/files/0b1793130550ea2e80c52cd5c28442f29364cddb063833d67b3c6d5995fd89dd - 0b1793130550ea2e80c52cd5c28442f29364cddb063833d67b3c6d5995fd89dd
/opt/CAPEv2/storage/analyses/3514/files/0d5db713081a8c823506739716ff483f6b68e203128b54ea3b807f9aa6fa7f49 - 0d5db713081a8c823506739716ff483f6b68e203128b54ea3b807f9aa6fa7f49
/opt/CAPEv2/storage/analyses/3514/files/36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 - 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
/opt/CAPEv2/storage/analyses/3514/files/84ce7e29868776de9939938d5c3091736669ebad4f063f5e83df0299b474e5ed - 84ce7e29868776de9939938d5c3091736669ebad4f063f5e83df0299b474e5ed
/opt/CAPEv2/storage/analyses/3514/files/2ff6914e5887b3fa53cb418b5602c84b79f189e441e1e66bf42c759688d8c885 - 2ff6914e5887b3fa53cb418b5602c84b79f189e441e1e66bf42c759688d8c885
/opt/CAPEv2/storage/analyses/3514/files/f6445229c496e05b84092b4ae5ad765233471acdcd12460b492d499001d623bf - f6445229c496e05b84092b4ae5ad765233471acdcd12460b492d499001d623bf
/opt/CAPEv2/storage/analyses/3514/files/f4a486a0ca6a53659159a404614c7e7edccb6bfbcdeb844f6cee544436a826cb - f4a486a0ca6a53659159a404614c7e7edccb6bfbcdeb844f6cee544436a826cb
/opt/CAPEv2/storage/analyses/3514/files/cfce9bfbe11b534e1fc28d59efed233b7490f081380a016b45b2357b4be1f173 - cfce9bfbe11b534e1fc28d59efed233b7490f081380a016b45b2357b4be1f173
/opt/CAPEv2/storage/analyses/3514/files/98b4b6a29374e68a383bd6e4b58cd76223335d38d2586c5a494466444811b75c - 98b4b6a29374e68a383bd6e4b58cd76223335d38d2586c5a494466444811b75c
/opt/CAPEv2/storage/analyses/3514/files/5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869 - 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
/opt/CAPEv2/storage/analyses/3514/files/a742b375fc6cb32e17c66f7e677cef59399216ac21c1384de6ec892c2b099a4d - a742b375fc6cb32e17c66f7e677cef59399216ac21c1384de6ec892c2b099a4d
/opt/CAPEv2/storage/analyses/3514/files/f5c82a141bdc7929bb3d6d4196c0e8501f4a894fd65a435f8134c073134461ac - f5c82a141bdc7929bb3d6d4196c0e8501f4a894fd65a435f8134c073134461ac

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

schemas.microsoft.com
6.me
z.eu
04o.br
z.se
f.au
www.msftconnecttest.com
dns.msftncsi.com
config.edge.skype.com
www.bing.com
msedge.api.cdp.microsoft.com
edge.microsoft.com
aps.prod.windows.com
ecs.office.com

File paths

n:\hz7

More PyInstaller samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report