MALICIOUS — virussign.com_98c7242bd34429be1ac4e7e14b6e3350.vir
MALICIOUS — virussign.com_98c7242bd34429be1ac4e7e14b6e3350.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Blackmoon family. 7 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ff84e8902c2037bbd5d1335f010d6f021f9456e47e228e690be49325cd53aece - SHA-1:
5ddcd70b82bdf7e9ef45bc158d39efa9d086cda1 - MD5:
98c7242bd34429be1ac4e7e14b6e3350 - imphash:
cdf5bbb8693f29ef22aef04d2a161dd7 - ssdeep:
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPtEUdI/CJTMGOS+:ymb3NkkiQ3mdBjFIj+qWgyGt+ - TLSH:
T10839F1F4585BB85CC838D07BAE96517C3A179810A97A87C90AC45914EFE92EF0BC7CD0 - Submitted as: virussign.com_98c7242bd34429be1ac4e7e14b6e3350.vir
- File type: pe · Size: 87963 bytes
- Verdict: malicious (96/100) · Family: Blackmoon
Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified
Detections (7 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
- ClamAV (daily): Win.Malware.Blackmoon-9864920-1
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Petite
- Microsoft Defender: Trojan:Win32/Blackmoon!rfn
- Trellix Stinger (McAfee): Trojan-FPCQ!F206A3CD82D0
- Kaspersky (KVRT): HEUR:Backdoor.Win32.Tiny.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Win.Malware.Blackmoon-9864920-1 (rule
Win.Malware.Blackmoon-9864920-1) - engine signal, weight 0.90, confidence 0.95 - Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Petite (rule
DIE:Petite) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-sections:, Petite - static signal, weight 0.25, confidence 0.55
- Dropped 25 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
1109 behavior events · 0 ATT&CK techniques · 28 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\lrbvjdn.exe -
7182eeb22619829a9da5fd3a54314a15071ec57685ad4742f916e722197da27b - C:\lppjtdj.exe -
e7e828be7ff17be2609891f505b5a4999dc0f1f879b1656b5462f5a01e5b2c36 - C:\xlddfvb.exe -
91ef29e44311f7eb40380d616d939b6412ef2865227fe29607d41644cf3cd4ab - C:\hbvlj.exe -
0ae2cb70e97c0b6d36fee638075cf1ee7025ac50de5ef71f590c9420e3b308da - C:\lfblppx.exe -
8670f997588870547d6ebcdb5aae7844b613c9ecab314c0fc4bfd05fd37e6848 - C:\frxrh.exe -
1a4206ccd2044a746faa4557ecacf0581485e9261a3bfd2a0f9c46400767bcfc - C:\xvfjppn.exe -
b340f4defacc7d6246e9955381e241c39b1d2caa6370a5dda140eee91560ff3f - C:\trfrpt.exe -
74e21e1741cdc47d5e51b661b51e86758fc61b12615205378e59eb1f2d3ff828 - C:\prpnflb.exe -
3c11843db3f1869f3298dc8a800d643f0cef3bfd5588e3e1c0b8b0f4c36260f1 - C:\xtvxj.exe -
2d4f5ecff91a5b27d381de27f10bd072b09d32bd538cf790e5af316755734813 - C:\jldhjvx.exe -
e53e55f087679d300033a6eddda2ac4ee5598e6acc067b7b99ad8286de8a4759 - C:\drjbtt.exe -
558079bc6305af55a232d098c20f0c92cf2facf2f80987d527909828ef890bde - C:\dvjpfbr.exe -
863208f6ed11aaada40bea2cb2ae54f84d9ea34260081828cd09f103cb1f0fc9 - C:\jrpxjd.exe -
29c469bd0a75b3528ad2128bfb9e788d6d73d1fda7f9c9e355dd817a980f965d - C:\trthrhb.exe -
6559fed008ea2effb6e6d5923fc6fcb7ba249c732829616812822a72225571cf
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787937644&P2=404&P3=2&P4=m5EWj9H%2bs5NLPWEv2mqS05bMmxq9nh4IkZHuYiME0Ct677gP1g46d%2fytjxOdyfnV%2b%2fTF%2feBSuAnEAawwYiNdSA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787937683&P2=404&P3=2&P4=DHK%2fb6FKAYAlRTR5zJACBmpdrL8mpXYdD8alqwKU6KRTPaWB2J22IzlqbZAaCajTYpTo2qp8nkn8NNCadDha%2bA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 4.150.223.113
- 52.123.252.245
- 20.247.185.124
- 52.123.252.247
- 20.42.179.192
- 4.230.171.124
- 20.165.94.46
- 20.165.94.63
- 20.165.94.54
- 20.42.65.88
- 20.236.44.162
- 52.123.128.14
- 40.104.4.2
- 52.123.129.14
- 203.26.79.13
- 20.42.65.89
- 135.234.160.246
- 4.247.188.224
- 4.150.223.108
- 52.148.114.188
- 52.110.12.26
- 52.110.12.46
- 72.154.7.104
- 52.110.12.2
More Blackmoon samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report