MALICIOUS — virussign.com_2095655529e4960cc1eb955417bb0250.vir

MALICIOUS — virussign.com_2095655529e4960cc1eb955417bb0250.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 55 detection engines flagged it.

Identification

SHA-256: e7a4d8c4cb01f787097c71dee3eb2303aa5af85418ca59a880d6c8276a234e38
SHA-1: 4d54e06a95777d047a941d862108df169a5e1442
MD5: 2095655529e4960cc1eb955417bb0250
imphash: 87bed5a7cba00c7e1f4015f1bdae2183
ssdeep: 384:+W4LDTs8hsF6qtK8lzQ8+Sych3mYvCPHxW:94LXVhaTtDE8VfCPHxW
TLSH: T15A289EEE4EB35358E2F554989C68E02C05A11CAE481E6E64F383E4ED02FF4B75074A76
Submitted as: virussign.com_2095655529e4960cc1eb955417bb0250.vir
File type: pe · Size: 17814 bytes
Verdict: malicious (75/100)

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (2 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
Detect It Easy (packer/type): DIE:Turbo Linker

Why this verdict

The malicious score of 75/100 is the fusion of 4 weighted signals:

Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 30 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX2,UPX3, Turbo Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

283 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787783424&P2=404&P3=2&P4=LRkU8M%2bhOWm9mk9bP4ha1Sd0aOb%2b0nvOqk%2fzv4178pObfNJIFnEF4bsQFPV5nACuH7UiZIFyliiWXy9%2fqaAVwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787783498&P2=404&P3=2&P4=SqoQlixgapogoPP6VpxUBd1sAlMkq%2f7BxeEo9imaL7nXCLFXQlfzKvzKIluIbTqgPJQBMfEDKUONULLjvwYVZQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787180260&P2=404&P3=2&P4=G8lENQUUEr3499yI9uq50hXCstAv50lFa5PLRgwkQCbF4lDZ25zWwa8ttR%2fYLBRq2dZrEB3bzbnxiEYgMcIwJQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787179773&P2=404&P3=2&P4=FP7bP8s7qkUC1G%2ftcZBSf0SXt7E7euX2C2MTYQg1%2bd006NxdyDekjcpi8He6AX5bz3Skjc6OneX0wGtAXEPwkQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.7
52.123.252.242
40.84.85.40
52.230.60.54
4.230.171.124
85.210.193.152
74.178.76.44
74.178.76.128
4.150.223.100
74.178.76.54
20.165.94.63
203.26.79.13
52.123.129.14
20.231.239.246
52.123.128.14
40.99.133.210
52.178.17.232
57.155.104.224
135.233.45.222
162.159.142.9
52.148.114.188
92.223.78.30
72.145.35.110
4.150.223.110
4.207.44.77

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report