SUSPICIOUS — virussign.com_8af9fc8c9d123c0fe09987e784f8e540.vir

SUSPICIOUS — virussign.com_8af9fc8c9d123c0fe09987e784f8e540.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (48/100), attributed to the AntiDebug family. 1 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: eb41cb8af83505fb50436fc41a9c8d1672830f34810fc8c66bb35d76fc264c14
• SHA-1: b52263b2c1f85f2b5a82c631064b199c5630c87e
• MD5: 8af9fc8c9d123c0fe09987e784f8e540
• imphash: 8a0a675368f9baceebd124f6a33ee0d9
• ssdeep: 49152:qOsL+j88wdY2VjrBvuryj5MPVixs7mFFgF3/OaYWNAi57:q+AkHF3/OaYWNAi57
• TLSH: T1E15D2AE161063211E6F1EC40F835C9ED9123B4C4A5711FCE820BE59A91A93FB92F85BD
• Submitted as: virussign.com_8af9fc8c9d123c0fe09987e784f8e540.vir
• File type: pe · Size: 2720891 bytes
• Verdict: suspicious (48/100) · Family: AntiDebug

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (1 of 55 engines)

• YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

• T1057

Why this verdict

The suspicious score of 48/100 is the fusion of 3 weighted signals:

• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://cosmocoffee.info/viewtopic.php?t=94Lensing, https://cosmocoffee.info/viewtopic.php?t=94 - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://cosmocoffee.info/viewtopic.php?t=94Lensing
• https://cosmocoffee.info/viewtopic.php?t=94

Embedded domains

• cosmocoffee.info

File paths

• C:\buildroot\x86_64-1520-posix-seh-ucrt-rt_v13-rev1\build\gcc-15.2.0\x86_64-w64-mingw32\libgcc

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report