MALICIOUS — virussign.com_7d8502898d7c168e267fb0bafb5b6df0.vir
MALICIOUS — virussign.com_7d8502898d7c168e267fb0bafb5b6df0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Socks family. 7 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
e8d2c0a713908d4ca9e98d0154c1351abfd4685e97de2901301f081823d35411 - SHA-1:
59cd113fb2bae7ef8b8eb19b4c335846dbb78457 - MD5:
7d8502898d7c168e267fb0bafb5b6df0 - imphash:
178689c38c1294cbf87aafcafb2357ed - ssdeep:
12288:ACCs5xOKx2NhMi8jxr/W17fAacczKiJO1vdGEVoBPvpMQ:AU5xOuifituA511VF45p - TLSH:
T13B5023E18311302DD765CEB669D599ED5446EF1CCEAABE134058B8928EFC41B312323E - Submitted as: virussign.com_7d8502898d7c168e267fb0bafb5b6df0.vir
- File type: pe · Size: 789958 bytes
- Verdict: malicious (100/100) · Family: Socks
Source: VirusSign · first seen 2026-07-18T00:00:00.000Z · SHA-256 verified
Detections (7 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Worm.Socks-10058896-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX 3.02
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Autorun
- Emsisoft (Emergency Kit): Trojan.Stealer.557
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 11 weighted signals:
- ClamAV (daily) flagged Win.Worm.Socks-10058896-0 (rule
Win.Worm.Socks-10058896-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7928) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:UPX 3.02 (rule
DIE:UPX 3.02) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, UPX 3.02 - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
8707 behavior events · 2 ATT&CK techniques · 13 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- bublikiadministrator.com
- bublikimanager.com
- desktop-hsgcbep
- dns.msftncsi.com
- config.edge.skype.com
- www.bing.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- aps.prod.windows.com
- ecs.office.com
- www.msftncsi.com
- g.live.com
- self.events.data.microsoft.com
- fs.microsoft.com
- msedge.api.cdp.microsoft.com
- 169.254.59.211
- 192.168.122.105
- 192.168.122.255
Dropped files
- /opt/CAPEv2/storage/analyses/3686/files/63eeaf0a7814450e81f881c102e2134e21feb9a932674a5944b122f315c0edf8 -
63eeaf0a7814450e81f881c102e2134e21feb9a932674a5944b122f315c0edf8 - /opt/CAPEv2/storage/analyses/3686/files/fff7726abe334e9b5aae3b4ba78eb3b5e56c0270911369748ba8270dd63822a3 -
fff7726abe334e9b5aae3b4ba78eb3b5e56c0270911369748ba8270dd63822a3 - /opt/CAPEv2/storage/analyses/3686/files/fe6cf402278c9678e1e7ed6a44a71c011cdb6c089e16b2c4ba106a4080538c95 -
fe6cf402278c9678e1e7ed6a44a71c011cdb6c089e16b2c4ba106a4080538c95 - /opt/CAPEv2/storage/analyses/3686/files/863d3f12d749b32dacfc9868030ebed5e8ef481f948e97d07334d0618093ddf9 -
863d3f12d749b32dacfc9868030ebed5e8ef481f948e97d07334d0618093ddf9 - /opt/CAPEv2/storage/analyses/3686/files/c54f4ea236894a7cf6b741cac5bd737095dc5e497d4513f10a73691d90ec63f7 -
c54f4ea236894a7cf6b741cac5bd737095dc5e497d4513f10a73691d90ec63f7 - /opt/CAPEv2/storage/analyses/3686/files/679207c71ece243c91bb6cdf1c19e35ccea7d6019543f5e75cbbd867fffd6443 -
679207c71ece243c91bb6cdf1c19e35ccea7d6019543f5e75cbbd867fffd6443 - /opt/CAPEv2/storage/analyses/3686/files/708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c -
708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c - /opt/CAPEv2/storage/analyses/3686/files/0ee3314451fbdaccae517ea2c5bd13772638d318d4473f1b1d4161f590715a81 -
0ee3314451fbdaccae517ea2c5bd13772638d318d4473f1b1d4161f590715a81 - /opt/CAPEv2/storage/analyses/3686/files/2666caa5577beaca6769556143b24d2c6125ec84870d5d3fd445d541fde2cf59 -
2666caa5577beaca6769556143b24d2c6125ec84870d5d3fd445d541fde2cf59 - /opt/CAPEv2/storage/analyses/3686/files/9d1517b426195c2e36c7eecf6ab646710177f1c5afa08fbad9892c3008ea9802 -
9d1517b426195c2e36c7eecf6ab646710177f1c5afa08fbad9892c3008ea9802 - /opt/CAPEv2/storage/analyses/3686/files/632e941747ee225e64d0e7d8306f6258ba33e4c3aa1e2541f9b678196cddc1c9 -
632e941747ee225e64d0e7d8306f6258ba33e4c3aa1e2541f9b678196cddc1c9 - /opt/CAPEv2/storage/analyses/3686/files/6f70333c3d599eb38468bbef91658116a8243da26c3eec92509cd0390661cc2d -
6f70333c3d599eb38468bbef91658116a8243da26c3eec92509cd0390661cc2d - 8c01fe909dab67b2351cf71fe99082f8acf24dc50fd3a466a51b010936797da7 -
8c01fe909dab67b2351cf71fe99082f8acf24dc50fd3a466a51b010936797da7
Embedded domains
- bublikiadministrator.com
- bublikimanager.com
- searchapp.bundleassets.example
- www.msftconnecttest.com
- dns.msftncsi.com
- config.edge.skype.com
- www.bing.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- aps.prod.windows.com
- ecs.office.com
- www.msftncsi.com
- g.live.com
- self.events.data.microsoft.com
- fs.microsoft.com
- msedge.api.cdp.microsoft.com
More Socks samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report