MALICIOUS — virussign.com_4b8debc9d619bf5b09026fcacc880600.vir

MALICIOUS — virussign.com_4b8debc9d619bf5b09026fcacc880600.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the Maldoc family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: d2647ebeb0badc8575fcef829543b127645bd27b80991e6808c4c571c11612bc
SHA-1: e44e5613d8c9a6491ab7db4aeb32f4f8a7625e2b
MD5: 4b8debc9d619bf5b09026fcacc880600
imphash: d058de892eb271cb836fb7509a04426e
ssdeep: 6144:iWF69d2HgFmRxLxCc2P5LynxkNAkYaSaM2NDhXmw1SYaDYXpEX1UnEv/P1UGv+ii:M2SpSYnEv2Gvxx8s9GZjghGAHhg6x6
TLSH: T1844E5BC1D887A58BC2A9D608D4E198DC483DF0A9F0B1D1A81642E199DDFCD3371BB64B
Submitted as: virussign.com_4b8debc9d619bf5b09026fcacc880600.vir
File type: pe · Size: 650149 bytes
Verdict: malicious (82/100) · Family: Maldoc

Source: VirusSign · first seen 2026-08-17T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

capa (capabilities): capability:credential-access
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
Trellix Stinger (McAfee): Trojan-FXIH!4B8DEBC9D619
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 82/100 is the fusion of 8 weighted signals:

access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 20 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis (windows)

40 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

2d5d05e4e4bc01ef2a9ce528df3e44f489f5219d8a4350f38878bca5371cc04d - 2d5d05e4e4bc01ef2a9ce528df3e44f489f5219d8a4350f38878bca5371cc04d

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787652050&P2=404&P3=2&P4=DzjKq%2fTWWh%2fZ0UDn3nvLI2eNLEhb90PLxuZtqfCWilw58ho1%2fdR9%2fCGhzdabzC0S2WJ%2bU3ytzUcN%2fkHasSz61A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

72.153.5.128
20.42.73.25
20.42.179.192
4.230.171.124
52.230.60.54
52.110.12.5
40.79.150.120
74.178.240.61
74.178.76.54
52.123.129.14
20.76.201.171
40.104.4.2
52.168.117.170
74.179.71.159
135.234.160.244
203.26.79.13
72.145.35.102
52.148.114.188
52.110.12.21
172.66.2.5

More Maldoc samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report