MALICIOUS — virussign.com_8434caf60bdfc20702b6be68a38df280.vir

MALICIOUS — virussign.com_8434caf60bdfc20702b6be68a38df280.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Revell family. 11 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

• SHA-256: dd34316234bb61ae29f7b2012d83f7c3e4352705a026531e8a768dd22ec43aaf
• SHA-1: ba1fbcdf8211b08e2a1bc2d35a966a47aff197f8
• MD5: 8434caf60bdfc20702b6be68a38df280
• imphash: c24091251b9ccb397d5b16313027ee31
• ssdeep: 196608:njBxcO4y3V2VAzEvlH2S9+ULdNPtbuPpq:Xll2AzEvlH2SlLdNPt6c
• TLSH: T10B66AD911F233301FAF69B1068604D6E54A2B49A30BD0E8E6743C53E9DB2DF3667506B
• Submitted as: virussign.com_8434caf60bdfc20702b6be68a38df280.vir
• File type: pe · Size: 6498312 bytes
• Verdict: malicious (100/100) · Family: Revell

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (11 of 55 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Trojan.Revell-1
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Worm:Win32/Bloored.E
• Emsisoft (Emergency Kit): Trojan.GenericKD.81102471
• Kaspersky (KVRT): Email-Worm.Win32.Bloored.e

MITRE ATT&CK

• T1055
• T1057
• T1056.001
• T1547.001
• T1518.001
• T1105

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Revell-1 (rule Win.Trojan.Revell-1) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• 2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
• Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 26 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://www.dropbox.com/oauth2/authorize, https://rna-resource.acrobat.com/static/js/misc/altDekstopCopyPasteHelper.js, https://www.googleapis.com/auth/userinfo.profile - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Dropped 66 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

19698 behavior events · 1 ATT&CK techniques · 68 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• licensing.mp.microsoft.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com

Dropped files

• C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-64.exe - 339e8bff76fa00c5d091acd515bd71b4bc45117b31120d94afd04e35fdd85d42
• C:\Program Files\LibreOffice\program\soffice.exe - 6c62b17a5f2da74815191ec20eb0a7111d24cee1fdf8dfe4a842e790d8dc7697
• C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 23d7a69f80e4c00d998c040ede43598d797601b4d2bf1a7450c180205e54d9ae
• C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\cli-arm64.exe - 14bdba24c65d574714ac779087bd77be1ec0bf306dc04d6e02c9169e008f2662
• C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.105\copilotapp.exe - 404224a039ffc306e3a65682441d4f9d4543c19ebd8b6f1129d0163e9b945020
• C:\Program Files\LibreOffice\program\unoinfo.exe - 2ee0385add8f8dfac37b24321028308f2a34356d6bf2c5d8d542fde702ca0b27
• C:\Program Files\LibreOffice\program\odbcconfig.exe - 5a4d445fbbb03f5ca178afb1c5bcbcca442f46b355393fa629328a2a88deb77b
• C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64.exe - cc1c97c7185cec34024a0c05fb91ac7d30b8ef1ec57705ed851669848928b642
• C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - 0e48bdcc511d8ee6d75d055d63f5c8253c1572bb5b7e628b0f89860a165807ef
• C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-arm64.exe - fbcd39d74e4d2853fe971b5266b8afc7c1f8ebf2700392954f4aedfefe7679a7
• C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe - 04a818f0f99b01b70059053db9469e17b26a7f97836cd65ab1797475324825a9
• C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 81d86f5819c63c01505364adea54ae2ef94e079045335fe4833fea77aa8f624e
• C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 751525fb4a583b58c951a0691fd746bec1633be981dcc69b59b8fa282c05de74
• C:\Program Files\LibreOffice\program\unopkg.exe - a3520b02eca0fa36a650a20bfcdd50a0dfc5cfd52a1e63f695b63754b22866cd
• C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 507b6fa7e558542f62a18b44d9be1ceec2b49c786e416c24229995ad1d0d276e

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• https://hg.mozilla.org/releases/mozilla-release/rev/a486bbf619936d4f8516c853ea6ffad2d576e2a3
• https://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-cs-g1.crl05
• http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
• http://www.digicert.com/CPS0
• https://www.dropbox.com/oauth2/authorize
• https://rna-resource.acrobat.com/static/js/misc/altDekstopCopyPasteHelper.js
• https://oobe.adobe.com/launch_external?url=
• https://oobe.adobe.com
• https://acrobat.adobe.com/us/en/landing/acrobat-pro-in-app.html?btn-url=https://rna-resource.acrobat.com/ob_preview/UpgradeToAcrobat
• https://stage.acrobat.adobe.com/us/en/landing/acrobat-pro-in-app.html?btn-url=https://rna-resource.acrobat.com/ob_preview/UpgradeToAcrobat
• https://helpx.adobe.com/security/products/flash-player/apsb20-58.html
• https://support.google.com/chrome/?p=plugin_flash
• https://support.google.com/chrome/answer/6258784
• https://www.google.com/cloudprint
• https://www.google.com/cloudprint/enable_chrome_connector
• https://chrome.google.com/webstore
• https://www.google.com/
• https://accounts.google.com/*
• https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
• https://acrobatoauth.adobe.com
• https://acrobatoauth.adobe.com/
• https://mail.google.com/

Embedded domains

• www.norton.com
• norton.com
• yahoo.com
• www.yahoo.com
• microsoft.com
• www.microsoft.com
• windowsupdate.com
• www.windowsupdate.com
• www.mcafee.com
• mcafee.com
• www.nai.com
• nai.com
• www.ca.com
• ca.com
• liveupdate.symantec.com
• www.sophos.com
• www.google.com
• rohitab.com
• www.rohitab.com
• securityresponse.symantec.com
• www.google.ca
• www.crackedmindstechnologies.com
• sf.net
• schemas.microsoft.com
• w.mx

Embedded IP addresses

• 20.184.175.19
• 52.110.12.8
• 52.110.12.37
• 52.230.59.222
• 4.230.171.124
• 172.215.188.232
• 172.215.188.225
• 74.178.76.128
• 4.150.223.103
• 135.232.92.97
• 20.112.250.133
• 40.99.133.242
• 52.123.128.14
• 40.99.134.18
• 52.123.252.229
• 135.233.45.223
• 203.26.79.13
• 57.154.63.210
• 52.148.114.188
• 74.178.232.29
• 52.123.252.239
• 72.145.35.100
• 135.234.160.246
• 20.42.73.27
• 52.110.12.30

Registry keys

• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/x-aiff]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\audio/aiff]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aiff]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aifc]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.aif]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\MIME\video/quicktime]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.qt]
• HKEY_CLASSES_ROOT\CLSID\{05589FA1-C356-11CE-BF01-00AA0055595A}\EnablePlugin\.mov]

File paths

• X:\:`:d:h:l:p:t:x:
• L:\:d:t:
• D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb
• D:\T\BuildResults\bin\Release\AcroCEF\RdrCEF.pdb
• d:\xpsprtm\base\fs\utils\dfrg\alloc.cpp
• d:\xpsprtm\base\fs\utils\dfrg\dasdread.cpp
• d:\xpsprtm\base\fs\utils\dfrg\dataio.cpp
• d:\xpsprtm\base\fs\utils\dfrg\dataiocl.cpp
• d:\xpsprtm\base\fs\utils\dfrg\devio.cpp
• d:\xpsprtm\base\fs\utils\dfrg\diskview.cpp
• d:\xpsprtm\base\fs\utils\dfrg\exclude.cpp
• d:\xpsprtm\base\fs\utils\dfrg\extents.cpp
• d:\xpsprtm\base\fs\utils\dfrg\fraggedfilelist.cpp
• d:\xpsprtm\base\fs\utils\dfrg\freespace.cpp
• d:\xpsprtm\base\fs\utils\dfrg\fssubs.cpp
• d:\xpsprtm\base\fs\utils\dfrg\gettime.cpp
• d:\xpsprtm\base\fs\utils\dfrg\intfuncs.cpp
• d:\xpsprtm\base\fs\utils\dfrg\loadfile.cpp
• c:\$MFT
• d:\xpsprtm\base\fs\utils\dfrg\movefile.cpp
• d:\xpsprtm\base\fs\utils\dfrg\ntfssubs.cpp
• d:\xpsprtm\base\fs\utils\dfrg\textblock.cpp
• d:\xpsprtm\base\fs\utils\dfrg\uicommon.cpp
• d:\xpsprtm\base\fs\utils\dfrg\dfrgntfs\dfrgntfs.cpp

More Revell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report