MALICIOUS — virussign.com_82621792b230f7b8e06a18343c5acd90.vir

MALICIOUS — virussign.com_82621792b230f7b8e06a18343c5acd90.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Guap family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: fe3c93450a7a0919321b645c496e7c98d998b706e9bb5097d0312db994bd395f
• SHA-1: e1ba0b8c1479d9dca281932bd518538adca6dff5
• MD5: 82621792b230f7b8e06a18343c5acd90
• imphash: b6230692891661869cecd581561a21f4
• ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioX/:zW6ncoyqOp6IsTl/mX/
• TLSH: T1B84CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112
• Submitted as: virussign.com_82621792b230f7b8e06a18343c5acd90.vir
• File type: pe · Size: 534785 bytes
• Verdict: malicious (94/100) · Family: Guap

Source: VirusSign · first seen 2026-07-30T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

• ClamAV (daily): Win.Worm.Guap-4
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
• Microsoft Defender: Trojan:Win32/Fsysna!pz
• Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1

MITRE ATT&CK

• T1547.001
• T1071.001

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• server.com
• tsymantec.com
• tsecurityresponse.symantec.com
• tsarc.com
• twww.sarc.com
• twww.sophos.com
• tsophos.com
• twww.mcafee.com
• tmcafee.com
• tliveupdate.symantecliveupdate.com
• twww.viruslist.com
• tviruslist.com
• tf-secure.com
• twww.f-secure.com
• tf-prot.com
• twww.f-prot.com
• tkaspersky.com
• tkaspersky-labs.com
• twww.avp.com
• tavp.com
• twww.kaspersky.com
• twww.networkassociates.com
• tnetworkassociates.com
• twww.ca.com
• tca.com

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• C:\Program
• C:\WINDOWS\system32\drivers\etc\hosts

More Guap samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report