MALICIOUS — virussign.com_e36d60d171d909f264a07df7ca256100.vir

MALICIOUS — virussign.com_e36d60d171d909f264a07df7ca256100.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the BlackMoon family. 8 of 55 detection engines flagged it.

Identification

• SHA-256: f9a6d48417b6af3a336fe2ea265a2119e735bfcbd4d9d86b76a8889ac7ad9e88
• SHA-1: 1c8fe5284e1eccc2f5a3c010e727bbae2358c108
• MD5: e36d60d171d909f264a07df7ca256100
• imphash: 9dacd5fc505421be83fd9ef325d44b59
• ssdeep: 1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJiRXDKFjI+pZ3W:0cdpeeBSHHMHLf9RyIEQ5KXZ3W
• TLSH: T1A03AFA6796A7B489C93470AB3B4F7351B0007DF00653799625ACE29FBEB318B46834C6
• Submitted as: virussign.com_e36d60d171d909f264a07df7ca256100.vir
• File type: pe · Size: 96779 bytes
• Verdict: malicious (93/100) · Family: BlackMoon

Source: VirusSign · first seen 2026-08-16T00:00:00.000Z · SHA-256 verified

Detections (8 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
• ClamAV (daily): Win.Trojan.BlackMoon-4255490-1
• YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
• Detect It Easy (packer/type): DIE:MPRESS
• Microsoft Defender: Worm:Win32/Ganelp.AF!MTB
• Emsisoft (Emergency Kit): Trojan.GenericKD.81098912
• Trellix Stinger (McAfee): Trojan-FPCQ!BA60F51D4D97
• Kaspersky (KVRT): Trojan-Dropper.Win32.Dinwod.acqn

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Trojan.BlackMoon-4255490-1 (rule Win.Trojan.BlackMoon-4255490-1) - engine signal, weight 0.90, confidence 0.95
• YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More BlackMoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report