MALICIOUS — virussign.com_a5dc42e966658f8bacc4b6ea63f69320.vir

MALICIOUS — virussign.com_a5dc42e966658f8bacc4b6ea63f69320.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Redirector family. 2 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: f42851e581693bab8d636be079d8d7227574c1b6f1a38a43be0e3c2bff0c34f0
SHA-1: 06f20ba5d9b8541051f660a37b2a89d8efb94ee3
MD5: a5dc42e966658f8bacc4b6ea63f69320
ssdeep: 24:kbxTSfWEQ/EUitV4momMi4ywox6IojMs7UnIyqIPbI:i9BEQ/ToomMi4ncRojMs70D9k
TLSH: T1B1128686F8666F6C5F0CEAC35B8841990CDB0246516C69885212395EBB188715844668
Submitted as: virussign.com_a5dc42e966658f8bacc4b6ea63f69320.vir
File type: html · Size: 1046 bytes
Verdict: malicious (92/100) · Family: Redirector

Source: VirusSign · first seen 2026-07-25T00:00:00.000Z · SHA-256 verified

Detections (2 of 51 engines)

Microsoft Defender: Trojan:JS/Redirector.PGRE!MTB
Emsisoft (Emergency Kit): Trojan.GenericKD.80941236

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 92/100 is the fusion of 8 weighted signals:

Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7612) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:JS/Redirector.PGRE!MTB (rule Trojan:JS/Redirector.PGRE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80941236 (rule Trojan.GenericKD.80941236) - engine signal, weight 0.55, confidence 0.85
Embedded network infrastructure: https://zezomev.maxudijuz.com/793780436842508077794583213432213951629859?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4NDgyNTU2OCwiaWF0IjoxNzg0ODE4MzY4LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMzJmNW1idmNtZm1uOXFrbzgwbmM0OGQiLCJuYmYiOjE3ODQ4MTgzNjgsInRzIjoxNzg0ODE4MzY4MzA0Njk0fQ.CekiZOySTjVeBBtNREe_B6H6M-ucnZaLf_F562K4PRI&sid=2bd16904-86a6-11f1-a5e0-0fa5cf7c0dad&titakofadulumematowogikamoxofimozesatepabumekafumuse=govajozutalikesaxiditifasamajusorodejumotodononuzemepavixanemaginudabojaniwezovezajezigawurozuwejumuledefakenapejofitamakagojanojiwixixuganofogoleron&utm_term=mexican+word+for+beautiful+girl&xuxewadotaraxebosebotomewajasafuvarixemagominewulesexojapibojazawiripegaj=ponikotebenojevonozekowogewirivakoriredipovedofakosoleroxowurekigebusokidovemoripomibavezuvaxasuvileviwexilovogupebifaxilirabapukukegadavumukamarosevodisusiwujenobibavebikamedutafemikogumuritikubofotaso - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

274 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

https://zezomev.maxudijuz.com/793780436842508077794583213432213951629859?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTc4NDgyNTU2OCwiaWF0IjoxNzg0ODE4MzY4LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMzJmNW1idmNtZm1uOXFrbzgwbmM0OGQiLCJuYmYiOjE3ODQ4MTgzNjgsInRzIjoxNzg0ODE4MzY4MzA0Njk0fQ.CekiZOySTjVeBBtNREe_B6H6M-ucnZaLf_F562K4PRI&sid=2bd16904-86a6-11f1-a5e0-0fa5cf7c0dad&titakofadulumematowogikamoxofimozesatepabumekafumuse=govajozutalikesaxiditifasamajusorodejumotodononuzemepavixanemaginudabojaniwezovezajezigawurozuwejumuledefakenapejofitamakagojanojiwixixuganofogoleron&utm_term=mexican+word+for+beautiful+girl&xuxewadotaraxebosebotomewajasafuvarixemagominewulesexojapibojazawiripegaj=ponikotebenojevonozekowogewirivakoriredipovedofakosoleroxowurekigebusokidovemoripomibavezuvaxasuvileviwexilovogupebifaxilirabapukukegadavumukamarosevodisusiwujenobibavebikamedutafemikogumuritikubofotaso

Embedded domains

zezomev.maxudijuz.com
www.msftconnecttest.com
searchapp.bundleassets.example
dns.msftncsi.com
config.edge.skype.com
aps.prod.windows.com
watson.events.data.microsoft.com
ecs.office.com
g.live.com
fs.microsoft.com
www.msftncsi.com
self.events.data.microsoft.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com
www.bing.com

More Redirector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report