MALICIOUS — virussign.com_1a26b1c91eb6dda61d434b86f750ab30.vir

MALICIOUS — virussign.com_1a26b1c91eb6dda61d434b86f750ab30.vir is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the HTML family. 1 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: fe8d4e3d6a0c6093766bb3a0a877e6de2d92630feee685a8b203e98d730d2f6c
• SHA-1: 806dc20cefea5b8254cbf99a8967875e8c4c3f12
• MD5: 1a26b1c91eb6dda61d434b86f750ab30
• ssdeep: 3072:QiUTXIAlqA2Ad1AxyMs0VA3rLf8me97nJV7jGG0zD+/GZqOZ+OSKj/6/7ppUTt:4V7wofJe97nD4
• TLSH: T1DB3FF645728A5E83C0920504F5C89B7990C5BF4F6C3868E6C246DFAEF44CD72E4B9D8A
• Submitted as: virussign.com_1a26b1c91eb6dda61d434b86f750ab30.vir
• File type: html · Size: 162382 bytes
• Verdict: malicious (88/100) · Family: HTML

Source: VirusSign · first seen 2026-07-17T00:00:00.000Z · SHA-256 verified

Detections (1 of 51 engines)

• YARA: delivr.to detections: DLV_HTML_Smuggling

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 88/100 is the fusion of 8 weighted signals:

• Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 6844) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Obfuscated powershell script: dynamic-exec, defense-evasion (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• YARA: delivr.to detections flagged DLV_HTML_Smuggling (rule DLV_HTML_Smuggling) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://ogp.me/ns#, http://ogp.me/ns/fb#, https://www.oktker.hu/feed/ - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Extracted generic config (20 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

277 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• searchapp.bundleassets.example
• www.msftconnecttest.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• www.bing.com
• desktop-hsgcbep
• config.edge.skype.com
• tas02.sls.update.microsoft.com
• dns.msftncsi.com
• to-do.microsoft.com
• settings-win.data.microsoft.com
• ctldl.windowsupdate.com
• watson.events.data.microsoft.com
• staging.to-do.microsoft.com
• edge.microsoft.com
• aps.prod.windows.com
• teams.microsoft.com

Embedded URLs

• http://ogp.me/ns#
• http://ogp.me/ns/fb#
• https://www.oktker.hu/feed/
• https://www.oktker.hu/comments/feed/
• https://www.oktker.hu/home/feed/
• https://www.oktker.hu/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.oktker.hu%2F
• https://www.oktker.hu/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.oktker.hu%2F&format=xml
• https://www.oktker.hu/
• https://www.oktker.hu/wp-content/uploads/2016/11/OKJ-tanfolyam-k
• https://www.oktker.hu/wp-content/plugins/cookie-notice/css/front.min.css?ver=3.1.2
• https://www.oktker.hu/wp-content/uploads/fusion-styles/c5282d8e9e7594d1d689240bf4c12097.min.css?ver=3.11.3
• https://www.oktker.hu/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
• https://www.oktker.hu/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
• https://www.oktker.hu/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.10.9.1
• https://www.oktker.hu/kosar/
• https://www.oktker.hu/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=10.9.1
• https://www.oktker.hu/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.10.9.1
• https://www.oktker.hu/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=10.9.1
• https://www.oktker.hu/wp-includes/js/underscore.min.js?ver=1.13.8
• https://www.oktker.hu/wp-includes/js/wp-util.min.js?ver=7.0
• https://www.oktker.hu/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart-variation.min.js?ver=10.9.1
• https://api.w.org/
• https://www.oktker.hu/wp-json/
• https://www.oktker.hu/wp-json/wp/v2/pages/570
• https://www.oktker.hu/xmlrpc.php?rsd

Embedded domains

• ogp.me
• api.w.org
• content-website-analytics.com
• www.facebook.com
• e.style.top
• s.w.org
• hu-manity.co
• www.oktker.hu
• oktker.hu
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.cloud.microsoft
• searchapp.bundleassets.example
• www.msftconnecttest.com
• outlook.office.com
• outlook.office365.com
• www.bing.com
• config.edge.skype.com
• tas02.sls.update.microsoft.com
• dns.msftncsi.com
• to-do.microsoft.com
• settings-win.data.microsoft.com
• ctldl.windowsupdate.com
• watson.events.data.microsoft.com
• staging.to-do.microsoft.com

More HTML samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report