35977e54b7472334546d60998e0be6d31f897e2c7212647b0ac33df51eae2f39
PE
Verdict: HOSTILE
AI
Obfuscated PE loader with high entropy
Local reference
Suspicious dependency
Inferred
virussign.com_db8f1af8c52f8d09f477abaa7cac23c0.vir
pe
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ..............Four-section PE with opaque high-entropy code |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
000000000000000000000000b8000000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
650da387216ccdd4216ccdd4216ccdd4 |
e...!l..!l..!l.. |
| 0x90 |
af73ded42b6ccdd4216ccdd4206ccdd4 |
.s..+l..!l.. l.. |
| 0xa0 |
52696368216ccdd40000000000000000 |
Rich!l.......... |
| 0xb0 |
0000000000000000504500004c010400 |
........PE..L... |
| 0xc0 |
f82dab540000000000000000e0000f01 |
.-.T............ |
| 0xd0 |
0b01050c00ac2e000016000000000000 |
................ |
| 0xe0 |
001000000010000000c02e0000004000 |
..............@. |
| 0xf0 |
00100000000200000400000000000000 |
................ |
| 0x100 |
040000000000000000002f0000060000 |
........../..... |
| 0x110 |
00000000020000000000100000 |
............. |
| 0x5c0 |
00000000000000000000000000000000 |
................ |
| 0x5d0 |
00000000000000000000000000000000 |
................ |
| 0x5e0 |
00000000000000000000000000000000 |
................ |
| 0x5f0 |
00000000000000000000000000000000 |
................ |
| 0x600 |
e8a0aa2e003d36ffffff0f8565000000 |
.....=6.....e...High entropy executable section |
| 0x610 |
e884aa2e00e873aa2e00e87aaa2e00e8 |
......s....z.... |
| 0x620 |
69aa2e00e864aa2e00e871aa2e00e86c |
i....d....q....l |
| 0x630 |
aa2e00e867aa2e00e85caa2e00e857aa |
....g....\....W. |
| 0x640 |
2e00e858aa2e00e853aa2e00e83caa2e |
...X....S....<.. |
| 0x650 |
00e849aa2e00e832aa2e00e839aa2e00 |
..I....2....9... |
| 0x660 |
e828aa2e00e835aa2e00e81eaa2e00e8 |
.(....5......... |
| 0x670 |
19aa2e00c3e82baa2e003de1feffff0f |
......+...=..... |
| 0x680 |
8592000000e80faa2e00e8fea92e00e8 |
................ |
| 0x690 |
05aa2e00e8f4a92e00e8efa92e00e8fc |
................ |
| 0x6a0 |
a9 |
. |
| 0x440e6 |
0122fe05d35122182e928518e24600c9 |
."...Q"......F.. |
| 0x440f6 |
dd6b481db2592a5ffc8365ccfd64cc4c |
.kH..Y*_..e..d.L |
| 0x44106 |
40faa71bbef4169299757dd6df62cb98 |
@........u}..b.. |
| 0x44116 |
2d3ecba52709174bc2f3b58a14337614 |
->..'..K.....3v. |
| 0x44126 |
0f010d4c5e4b727f13f9ccbc63ed35a7 |
...L^Kr.....c.5.SIDT stores x86 IDT register in memory |
| 0x44136 |
b69ebc6437605c01db46d466094dca2f |
...d7`\..F.f.M./ |
| 0x44146 |
f415d25e220affcb62a51c21de67abb1 |
...^"...b..!.g.. |
| 0x44156 |
8d7f4882b40462ebd5cba14bf212d80b |
..H...b....K.... |
| 0x44166 |
9fa7fff592a77ef493a77274da2a6fae |
......~...rt.*o. |
| 0x44176 |
1f91fd48c06e4c663ba0673db2dfba51 |
...H.nLf;.g=...Q |
| 0x44186 |
806e4c72bb8357bd1689fe5080ae4c70 |
.nLr..W....P..Lp |
| 0x44196 |
2f8361ed17d09a40a03cccf5f4e564bd |
/.a....@.<....d. |
| 0x441a6 |
5635d217c06e7c6691f762 |
V5...n|f..b |
| 0x2eb5a0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5b0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5c0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5d0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5e0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5f0 |
00000000000000000000000000000000 |
................ |
| 0x2eb600 |
00000000000000000400000000000200 |
................Executable PE resource section |
| 0x2eb610 |
03000000200000800e00000038000080 |
.... .......8... |
| 0x2eb620 |
00000000000000000400000000000100 |
................ |
| 0x2eb630 |
01000000500000800000000000000000 |
....P........... |
| 0x2eb640 |
04000000000001000100000068000080 |
............h... |
| 0x2eb650 |
00000000000000000400000000000100 |
................ |
| 0x2eb660 |
09040000800000000000000000000000 |
................ |
| 0x2eb670 |
04000000000001000904000090000000 |
................ |
| 0x2eb680 |
a0e02e00a8100000e404000000000000 |
................ |
| 0x2eb690 |
48f12e0014000000e404000000000000 |
H............... |
| 0x2eb6a0 |
28000000200000004000000001002000 |
(... ...@..... . |
| 0x2eb6b0 |
00000000000000000000000000000000 |
................ |
| 0x2eb6c0 |
00000000000000000000000000000000 |
................ |
| 0x2eb6d0 |
0000000000000000000000000000 |
.............. |
Objectives
| 0x0 |
4d5a90000300000004000000ffff0000 |
MZ.............. |
| 0x10 |
b8000000000000004000000000000000 |
........@....... |
| 0x20 |
00000000000000000000000000000000 |
................ |
| 0x30 |
000000000000000000000000b8000000 |
................ |
| 0x40 |
0e1fba0e00b409cd21b8014ccd215468 |
........!..L.!Th |
| 0x50 |
69732070726f6772616d2063616e6e6f |
is program canno |
| 0x60 |
742062652072756e20696e20444f5320 |
t be run in DOS |
| 0x70 |
6d6f64652e0d0d0a2400000000000000 |
mode....$....... |
| 0x80 |
650da387216ccdd4216ccdd4216ccdd4 |
e...!l..!l..!l.. |
| 0x90 |
af73ded42b6ccdd4216ccdd4206ccdd4 |
.s..+l..!l.. l.. |
| 0xa0 |
52696368216ccdd40000000000000000 |
Rich!l.......... |
| 0xb0 |
0000000000000000504500004c010400 |
........PE..L... |
| 0xc0 |
f82dab540000000000000000e0000f01 |
.-.T............ |
| 0xd0 |
0b01050c00ac2e000016000000000000 |
................ |
| 0xe0 |
001000000010000000c02e0000004000 |
..............@. |
| 0xf0 |
00100000000200000400000000000000 |
................ |
| 0x100 |
040000000000000000002f0000060000 |
........../..... |
| 0x110 |
00000000020000000000100000 |
............. |
Micro-behaviors
| 0x440e6 |
0122fe05d35122182e928518e24600c9 |
."...Q"......F.. |
| 0x440f6 |
dd6b481db2592a5ffc8365ccfd64cc4c |
.kH..Y*_..e..d.L |
| 0x44106 |
40faa71bbef4169299757dd6df62cb98 |
@........u}..b.. |
| 0x44116 |
2d3ecba52709174bc2f3b58a14337614 |
->..'..K.....3v. |
| 0x44126 |
0f010d4c5e4b727f13f9ccbc63ed35a7 |
...L^Kr.....c.5. |
| 0x44136 |
b69ebc6437605c01db46d466094dca2f |
...d7`\..F.f.M./ |
| 0x44146 |
f415d25e220affcb62a51c21de67abb1 |
...^"...b..!.g.. |
| 0x44156 |
8d7f4882b40462ebd5cba14bf212d80b |
..H...b....K.... |
| 0x44166 |
9fa7fff592a77ef493a77274da2a6fae |
......~...rt.*o. |
| 0x44176 |
1f91fd48c06e4c663ba0673db2dfba51 |
...H.nLf;.g=...Q |
| 0x44186 |
806e4c72bb8357bd1689fe5080ae4c70 |
.nLr..W....P..Lp |
| 0x44196 |
2f8361ed17d09a40a03cccf5f4e564bd |
/.a....@.<....d. |
| 0x441a6 |
5635d217c06e7c6691f762 |
V5...n|f..b |
Metadata
| 0x2eb5a0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5b0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5c0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5d0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5e0 |
00000000000000000000000000000000 |
................ |
| 0x2eb5f0 |
00000000000000000000000000000000 |
................ |
| 0x2eb600 |
00000000000000000400000000000200 |
................ |
| 0x2eb610 |
03000000200000800e00000038000080 |
.... .......8... |
| 0x2eb620 |
00000000000000000400000000000100 |
................ |
| 0x2eb630 |
01000000500000800000000000000000 |
....P........... |
| 0x2eb640 |
04000000000001000100000068000080 |
............h... |
| 0x2eb650 |
00000000000000000400000000000100 |
................ |
| 0x2eb660 |
09040000800000000000000000000000 |
................ |
| 0x2eb670 |
04000000000001000904000090000000 |
................ |
| 0x2eb680 |
a0e02e00a8100000e404000000000000 |
................ |
| 0x2eb690 |
48f12e0014000000e404000000000000 |
H............... |
| 0x2eb6a0 |
28000000200000004000000001002000 |
(... ...@..... . |
| 0x2eb6b0 |
00000000000000000000000000000000 |
................ |
| 0x2eb6c0 |
00000000000000000000000000000000 |
................ |
| 0x2eb6d0 |
0000000000000000000000000000 |
.............. |
-
0x0
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 65 0d a3 87 21 6c cd d4 21 6c cd d4 21 6c cd d4 af 73 de d4 2b 6c cd d4 21 6c cd d4 20 6c cd d4 52 69 63 68 21 6c cd d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f8 2d ab 54 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 0c 00 ac 2e 00 00 16 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 c0 2e 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 2f 00 00 06 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!l..!l..!l...s..+l..!l.. l..Rich!l..................PE..L....-.T..........................................@.........................../..................
×8
| 0x5c0 |
00000000000000000000000000000000 |
................ |
| 0x5d0 |
00000000000000000000000000000000 |
................ |
| 0x5e0 |
00000000000000000000000000000000 |
................ |
| 0x5f0 |
00000000000000000000000000000000 |
................ |
| 0x600 |
e8a0aa2e003d36ffffff0f8565000000 |
.....=6.....e... |
| 0x610 |
e884aa2e00e873aa2e00e87aaa2e00e8 |
......s....z.... |
| 0x620 |
69aa2e00e864aa2e00e871aa2e00e86c |
i....d....q....l |
| 0x630 |
aa2e00e867aa2e00e85caa2e00e857aa |
....g....\....W. |
| 0x640 |
2e00e858aa2e00e853aa2e00e83caa2e |
...X....S....<.. |
| 0x650 |
00e849aa2e00e832aa2e00e839aa2e00 |
..I....2....9... |
| 0x660 |
e828aa2e00e835aa2e00e81eaa2e00e8 |
.(....5......... |
| 0x670 |
19aa2e00c3e82baa2e003de1feffff0f |
......+...=..... |
| 0x680 |
8592000000e80faa2e00e8fea92e00e8 |
................ |
| 0x690 |
05aa2e00e8f4a92e00e8efa92e00e8fc |
................ |
| 0x6a0 |
a9 |
. |
-
0x0
4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 65 0d a3 87 21 6c cd d4 21 6c cd d4 21 6c cd d4 af 73 de d4 2b 6c cd d4 21 6c cd d4 20 6c cd d4 52 69 63 68 21 6c cd d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 f8 2d ab 54 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 0c 00 ac 2e 00 00 16 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 c0 2e 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 2f 00 00 06 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!l..!l..!l...s..+l..!l.. l..Rich!l..................PE..L....-.T..........................................@.........................../..................
Identity
| SHA-256 |
35977e54b7472334546d60998e0be6d31f897e2c7212647b0ac33df51eae2f39 |
| Filename |
virussign.com_db8f1af8c52f8d09f477abaa7cac23c0.vir |
| Package |
35977e54b7472334546d60998e0be6d31f897e2c7212647b0ac33df51eae2f39 |
Origin
| Source |
harvest |
| Feed |
virussign |
| Domain |
virussign.com |
Timeline
| First seen |
5 Aug 2026 17:31 UTC |
| First analyzed |
5 Aug 2026 23:53 UTC |
| Last analyzed |
5 Aug 2026 23:53 UTC |
| Last updated |
5 Aug 2026 23:53 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
b5ca8 |