MALICIOUS — virussign.com_0d01fafa65306175618acc78198374b0.vir

MALICIOUS — virussign.com_0d01fafa65306175618acc78198374b0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Pioneer family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: f463fd7ae33a7c203d9856a1278cad515da09a0eff68d5832706fad31d8689ab
• SHA-1: 5b23487d5436978631fcee16e0648e5f7d799e6a
• MD5: 0d01fafa65306175618acc78198374b0
• imphash: c3bf75488e36fd490529637239c3f143
• ssdeep: 98304:/sj4C+3mHt2boT95Mjq8hX6BziqyBTS/MF6+nWT:/sh5825MXh2GqyJz6+nu
• TLSH: T16863BFCE1F9F5342C6F0DB94AC501A8D246370A970BD598DD782C13D29A7C7BAE210A7
• Submitted as: virussign.com_0d01fafa65306175618acc78198374b0.vir
• File type: pe · Size: 4872840 bytes
• Verdict: malicious (96/100) · Family: Pioneer

Source: VirusSign · first seen 2026-08-09T00:00:00.000Z · SHA-256 verified

Detections (7 of 52 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Virus.Pioneer-9111434-0
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Virus:Win32/Floxif.H
• Emsisoft (Emergency Kit): Win32.Floxif.A
• Kaspersky (KVRT): Virus.Win32.Pioneer.cz

MITRE ATT&CK

• T1547.001
• T1071.001
• T1057
• T1056.001

Why this verdict

The malicious score of 96/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Win.Virus.Pioneer-9111434-0 (rule Win.Virus.Pioneer-9111434-0) - engine signal, weight 0.90, confidence 0.95
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://cyberarticle.wiz.cn/, http://api.wiz.cn/, http://service.wiz.cn/wizkm/xmlrpc - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://cyberarticle.wiz.cn/
• http://api.wiz.cn/
• http://service.wiz.cn/wizkm/xmlrpc
• https://accounts.wizkm.com/wizkm/xmlrpc
• http://xspf.org/ns/0/
• http://www.msdn.microsoft.com/visualc/
• http://cafe.daum.net/HIGHFIVESHARK/qA9W/10
• http://cafe.daum.net/_c21_/cafeon?grpid=1YSCe
• http://cafe.daum.net/_c21_/static/bgm/bgm.html
• http://cafe.daum.net/_c21_/recent_bbs_read?grpid=1YSCe&amp
• http://cafe.daum.net/_cafe/favoritecafe_domain_blank.html
• https://api-item.daum.net/cors/?xdm_e=http%3A%2F%2Fcafe.daum.net&amp
• https://api-item.daum.net/cors/?xdm_e=http://cafe.daum.net&amp
• http://t1.daumcdn.net/cafe_cj/pcweb/css/469/2009/default.css
• http://t1.daumcdn.net/cafe_image/cf_img4/bg/icon_write.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/bg/icon_photo.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/img/icon_chat.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/bbs/icon_recommend.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/bg/icon_select.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/bg/ico_reply.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/design/home/img_check.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/img/btn_info.png
• http://t1.daumcdn.net/cafe_image/cf_img4/bg/ico_star3.png
• http://t1.daumcdn.net/cafe_image/cf_img4/img/icon_new.gif
• http://t1.daumcdn.net/cafe_image/cf_img4/img/icon_file_photo.gif

Embedded domains

• cyberarticle.wiz.cn
• api.wiz.cn
• service.wiz.cn
• accounts.wizkm.com
• xspf.org
• www.msdn.microsoft.com
• cafe.daum.net
• api-item.daum.net
• t1.daumcdn.net
• i1.daumcdn.net
• img-contents.daum-img.net
• s1.cafe.daumcdn.net
• s1.daumcdn.net
• mk.kakaocdn.net
• search1.daumcdn.net
• cfile269.uf.daum.net
• cfile299.uf.daum.net
• cfile268.uf.daum.net
• cfile254.uf.daum.net
• cfile273.uf.daum.net
• cfile264.uf.daum.net
• cfile261.uf.daum.net
• cafeimg.hanmail.net
• cafeimg.daum-img.net
• logins.daum.net

File paths

• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewform.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
• f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
• c:\Program

More Pioneer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report