SUSPICIOUS — virussign.com_30ff03addd95fc4c8364793202390ce0.vir

SUSPICIOUS — virussign.com_30ff03addd95fc4c8364793202390ce0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (46/100). 2 of 55 detection engines flagged it.

Identification

SHA-256: fd57b3a66da20281184202204669eeab9f178a88cd9593094b0fe3b6a570fd72
SHA-1: 1313413f67a74539b0a54ff513454317548729b0
MD5: 30ff03addd95fc4c8364793202390ce0
imphash: 6fd4bf0cf0a166bdeae84840774c5d41
ssdeep: 3072:assi7dMb20ylMZLq4OSGP5555555555555xAOCynzqyJA3I3qbY:aSe9OfwynzqyJA3I3G
TLSH: T1D2434BE55DBA0601E0F8CD9BF85894ED5083F7B2137E008D8A62D13BEBD589BA43445E
Submitted as: virussign.com_30ff03addd95fc4c8364793202390ce0.vir
File type: pe · Size: 221184 bytes
Verdict: suspicious (46/100)

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (2 of 55 engines)

Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Trojan.GenericKD.81021365

Why this verdict

The suspicious score of 46/100 is the fusion of 2 weighted signals:

Contacted 26 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://www.iec.ch - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

720 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.iec.ch
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787851554&P2=404&P3=2&P4=Foi%2fArFZMAdfF7bHSPwIj1yBFlomSbQlyw9RqaZbbiyaGGAbVcyrvce2ZT35AZwdNsZfTmcM9pRC5jiCb%2blZgA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787851596&P2=404&P3=2&P4=UWxgOwD1JPXXy3N5L2pWKZn5RwqGs8Vrkn6quiaY4PdQ9ldPhwhsZuv5hcCEft3pxxhRzlmI061xWWQOb7z1Dg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787248236&P2=404&P3=2&P4=H%2fl%2f8r%2fZ6XLG%2blNBiyl0gc12ZK0u6rpyfmmx0TCrF7zsKLDlPmqs%2bK6Oa991iC%2f%2blGDd0oV%2bRcxSHucs98QpDw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787247823&P2=404&P3=2&P4=MrIUZiOqrqVz2BDPIRU98tWQ%2fjDGhLJbbVWTOmoSeqS%2f61j01A%2bfOxiTMIwXG5UjJSo9Ct16zwmvu0A43ibP9Q%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.iec.ch
medrcedutech.com

Embedded IP addresses

52.123.252.198
51.116.253.168
4.230.171.124
40.84.85.40
57.155.104.224
20.247.184.197
20.165.94.63
74.179.77.164
20.184.175.3
135.233.95.144
20.236.44.162
52.123.129.14
135.234.160.246
203.26.79.13
135.232.92.34
52.148.114.188
52.110.12.49
52.110.12.20
92.223.78.30
172.170.180.133
72.154.7.112
52.178.17.232
40.79.197.34
74.178.232.29
52.110.12.37

File paths

C:\PROGRAM

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report