AI
High-entropy packed PE loader
Local reference
Suspicious dependency
Inferred
Mal-ecule
O(As₃)H(Cm)Md₂(Bi₆)
High-entropy PE with writable entry section: virussign.com_e65b9b93c9cff432693e3afa60022060.vir:0x0
Large encoded configuration data section: virussign.com_e65b9b93c9cff432693e3afa60022060.vir:0x0
| 0x0 | 4d5a90000300000004000000ffff0000 | MZ..............High-entropy PE with writable entry section |
| 0x10 | b8000000000000004000000000000000 | ........@....... |
| 0x20 | 00000000000000000000000000000000 | ................ |
| 0x30 | 00000000000000000000000080000000 | ................ |
| 0x40 | 0e1fba0e00b409cd21b8014ccd215468 | ........!..L.!Th |
| 0x50 | 69732070726f6772616d2063616e6e6f | is program canno |
| 0x60 | 742062652072756e20696e20444f5320 | t be run in DOS |
| 0x70 | 6d6f64652e0d0d0a2400000000000000 | mode....$....... |
| 0x80 | 504500004c010500002e930200000000 | PE..L........... |
| 0x90 | 00000000e0000f030b010304f07c0000 | .............|.. |
| 0xa0 | 00d00000206f0100cc87000000100000 | .... o.......... |
| 0xb0 | 00900000000040000010000000020000 | ......@......... |
| 0xc0 | 04000000010000000400000000000000 | ................ |
| 0xd0 | 00f00200000400000000000003000000 | ................ |
| 0xe0 | 00000001001000000000100000100000 | ................ |
| 0xf0 | 00000000100000000000000000000000 | ................ |
| 0x100 | 000000000000000000e0020010000000 | ................ |
| 0x110 | 00000000000000000000000000000000 | ................ |
| 0x120 | 000000 | ... |
| 0x380 | 00000000000000000000000000000000 | ................ |
| 0x390 | 00000000000000000000000000000000 | ................ |
| 0x3a0 | 00000000000000000000000000000000 | ................ |
| 0x3b0 | 00000000000000000000000000000000 | ................ |
| 0x3c0 | 00000000000000000000000000000000 | ................ |
| 0x3d0 | 00000000000000000000000000000000 | ................ |
| 0x3e0 | 00000000000000000000000000000000 | ................ |
| 0x3f0 | 00000000000000000000000000000000 | ................ |
| 0x400 | 25698f1a02d05a992c46f4d3a46c1900 | %i....Z.,F...l..High-entropy PE with writable entry section |
| 0x410 | 285bd5b868fc771c5fc42091158b084d | ([..h.w._. ....M |
| 0x420 | 741e94f4a436dbb18a67d149df803c23 | t....6...g.I..<# |
| 0x430 | 7c89159f98fec5520d12c406cbda5a4a | |......R......ZJ |
| 0x440 | dc70204935946ac603dfea2f99eb68a5 | .p I5.j..../..h. |
| 0x450 | cba3ba0dfa72fb7f19d61915355204c1 | .....r......5R.. |
| 0x460 | 14a9be6f3505760184264f7ce56c3e35 | ...o5.v..&O|.l>5 |
| 0x470 | f68bd4c59dff7a686556c994ec95bb1c | ......zheV...... |
| 0x480 | dee1d157de2b84fbe7a841673d87240b | ...W.+....Ag=.$. |
| 0x490 | 44b568551f9b193c4e346197537cc8de | D.hU...<N4a.S|.. |
| 0x4a0 | 17353c858fb5488c9cea1525c2557727 | .5<...H....%.Uw' |
| 0x4b0 | 56d1c011db108b37fe93ac3d888dee49 | V......7...=...I |
| 0x4c0 | b8afbfcb9db36e87f6dddd073dbd5003 | ......n.....=.P. |
| 0x4d0 | bfb03f94384449c96b2227d3420d5f4a | ..?.8DI.k"'.B._J |
| 0x4e0 | a6b9a9272ab159ad7751f93d615b0e92 | ...'*.Y.wQ.=a[.. |
| 0x4f0 | dd7b4799b8eb517dc1f655c458a29723 | .{G...Q}..U.X..# |
| 0x500 | 94e3a350bc8584ece2aae60f13402b78 | ...P.........@+x |
| 0x510 | 87f02d401b09e6ac7f5517c41c4438ed | ..-@.....U...D8. |
| 0x520 | 7e16263738bd85d8d6728f704338 | ~.&78....r.pC8 |
| 0x80df | 70bcc7e0fea68feeee3e15f4454ce6b5 | p........>..EL.. |
| 0x80ef | 7f9d6f6e646974696f6e732e204d6963 | ..onditions. Mic |
| 0x80ff | 726f736f66742077617272616e747320 | rosoft warrants |
| 0x810f | 746861742070726f7065726c79206c69 | that properly li |
| 0x811f | 63656e73656420736f66747761726520 | censed software |
| 0x812f | 77696c6c20706572666f726d20737562 | will perform sub |
| 0x813f | 7374616e7469616c6c79206173206465 | stantially as de |
| 0x814f | 7363726962656420696e0a636f6e7472 | scribed in.contr |
| 0x815f | 6f7665727379206265747765656e2079 | oversy between y |
| 0x816f | 6f7520616e64204d6963726f736f6674 | ou and Microsoft |
| 0x817f | 20636f6e6365726e696e672074686520 | concerning the |
| 0x818f | 736f6674776172652028696e636c7564 | software (includ |
| 0x819f | 696e672069747320707269636529206f | ing its price) o |
| 0x81af | 7220746869732061677265656d656e74 | r this agreement |
| 0x81bf | 2c0a557365722c204d61726b6574696e | ,.User, Marketin |
| 0x81cf | 6720557365722c204d616e7566616374 | g User, Manufact |
| 0x81df | 7572696e6720557365722c2050757263 | uring User, Purc |
| 0x81ef | 686173696e6720557365722c2054656c | hasing User, Tel |
| 0x81ff | 65de4cefbb43d05a992c36b4d3a46c19 | e.L..C.Z.,6...l.Large encoded configuration data section |
| 0x820f | 00270ff11929fc771c5fc4209145f948 | .'...).w._. .E.H |
| 0x821f | 4d7bb0bc55e536dbb18a67d149df803c | M{..U.6...g.I..< |
| 0x822f | 2382ac793ea96e85520d12c406cbda5a | #..y>.n.R......Z |
| 0x823f | 4a235550e874946ac603dfea2f99eb68 | J#UP.t.j..../..h |
| 0x824f | a53486ceacbb72fb7f19d61915355204 | .4....r......5R. |
| 0x825f | c1eb8cc6ce7405760184264f7ce56c3e | .....t.v..&O|.l> |
| 0x826f | 3559dee964d8ff7a6805268894b896bb | 5Y..d..zh.&..... |
| 0x827f | 1ce1b710f6cb2884fbc7df0067698424 | ......(.....gi.$ |
| 0x828f | 0b3beaadf40a98193cae492097077fc8 | .;......<.I .... |
| 0x829f | dea891f524ccb5488ccc6b5425c65577 | ....$..H..kT%.Uw |
| 0x82af | 27c9750db09e108b378e12ed3d8c8dee | '.u.....7...=... |
| 0x82bf | 49c70b6e6ad8b36e87665c9c0739bd50 | I..nj..n.f\..9.P |
| 0x82cf | 035016ea357d4449c94ba166d3460d5f | .P..5}DI.K.f.F._ |
| 0x82df | 4a69 | Ji |
| 0x87a0 | 00000000000000000000000000000000 | ................ |
| 0x87b0 | 00000000000000000000000000000000 | ................ |
| 0x87c0 | 00000000000000000000000000000000 | ................ |
| 0x87d0 | 00000000000000000000000000000000 | ................ |
| 0x87e0 | 00000000000000000000000000000000 | ................ |
| 0x87f0 | 00000000000000000000000000000000 | ................ |
| 0x8800 | da4ceebbbc2fa566c582f4d3566f545a | .L.../.f....VoTZLarge encoded configuration data section |
| 0x8810 | 477eb21929fc731c5fc4df6e158bb04d | G~..).s._..n...M |
| 0x8820 | 8a3bee15e236d4b38a6d22675f803c23 | .;...6...m"g_.<# |
| 0x8830 | 8db3c330d94acc9f2caac54a06fb0e22 | ...0.J..,..J..." |
| 0x8840 | 4a26709806fb0db462b2ca4cf88506ca | J&p.....b..L.... |
| 0x8850 | 40a6acc99b008e1139bf7735711d57e1 | @.......9.w5q.W. |
| 0x8860 | 86e3a2ab5a087b0ba07c4f0fb5293e35 | ....Z.{..|O..)>5 |
| 0x8870 | 45afae6adcfd786895592994e396b01d | E..j..xh.Y)..... |
| 0x8880 | 22c0a1499f2b00fee7a8b1433d87b4c4 | "..I.+.....C=... |
| 0x8890 | bb90ece45e9b19ec6a3473d75f7cdadc | ....^...j4s._|.. |
| 0x88a0 | 5010a7250eb5498e9cc8a524d7555627 | P..%..I....$.UV' |
| 0x88b0 | a92c4cb185108b0ffe93913d8985ee4c | .,L........=...L |
| 0x88c0 | 408a2d68dcf1ce86f68dd70732bf5021 | @.-h........2.P! |
| 0x88d0 | 1fa57e35795c73c96b72a772430d6fd3 | ..~5y\s.kr.rC.o. |
| 0x88e0 | 599333866f3177d912298d3d615bea92 | Y.3.o1w..).=a[.. |
| 0x88f0 | 22c5db10f92b947dc3f4556678a29743 | "....+.}..Ufx..C |
| 0x8900 | 45a262859c858cede356e60f384139bc | E.b......V..8A9. |
| 0x8910 | 58d58de35a6ba6ac7f9539b635441951 | X...Zk....9.5D.Q |
| 0x8920 | fe728f94e4bc9112f4728d7243b85f01 | .r.......r.rC._. |
| 0x8930 | a6cfc08cb29905ba4cb2b45013ad71f1 | ........L..P..q. |
| 0x8940 | 497b1ba7f96760692ada1122c4340c58 | I{...g`i*..".4.X |
| 0x8950 | 307fa9f333226f16a6ef935d4116df8c | 0...3"o....]A... |
| 0x8960 | 2171d05f8318529a4c2eb6dc25c5e57f | !q._..R.L...%... |
| 0x8970 | df91ba13ef0348dddea957bb732e27ad | ......H...W.s.'. |
| 0x8980 | 1cdad90c024e5f3395af1d96c65452fa | .....N_3.....TR. |
| 0x8990 | 0e97717e3aa987ce14e833546eaad576 | ..q~:.....3Tn..v |
| 0x89a0 | fb9bb87e7f3f6f164742ac304c80dd51 | ...~.?o.GB.0L..Q |
| 0x89b0 | cceda62f3dbeaf040e43a08596d97c05 | .../=....C....|. |
| 0x89c0 | bd885ff5445f1099ef5ed7cd7552d70c | .._.D_...^..uR.. |
| 0x89d0 | be003ce16463918e0c646eedf8d3874c | ..<.dc...dn....L |
| 0x89e0 | 5333de0c8e5a41c4c8c0a579a5bfbe90 | S3...ZA....y.... |
| 0x89f0 | 64965151ca4cf44f53d041613c46ef2f | d.QQ.L.OS.Aa<F./ |
| 0x8a00 | b46c3300757eb3022dec770757d4208a | .l3.u~..-.w.W. . |
| 0x8a10 | 199b08569b2bfc4ef126dbaa9277d152 | ...V.+.N.&...w.R |
| 0x8a20 | c3903c38a3bc7925fdeec5492502c41d | ..<8..y%...I%... |
| 0x8a30 | e7ca5a51134550f340846add3bcfea34 | ..ZQ.EP.@.j.;..4 |
| 0x168a1 | 65207573696e672c20616e640a547261 | e using, and.Tra |
| 0x168b1 | 646520436f6d706c69616e6365207765 | de Compliance we |
| 0x168c1 | 6220736974652077686963682063616e | b site which can |
| 0x168d1 | 20626520616363657373656420617420 | be accessed at |
| 0x168e1 | 687474703a2f2f6f7261636c652e636f | http://oracle.co |
| 0x168f1 | 6d2f636f6e7472616374732e20596f75 | m/contracts. You |
| 0x16901 | 2061677265652074686174206e6f2064 | agree that no d |
| 0x16911 | 6174612c20696e666f726d6174696f6e | ata, information |
| 0x16921 | 2c0a5448452044495350555445205749 | ,.THE DISPUTE WI |
| 0x16931 | 4c4c20424520434f4e44554354454420 | LL BE CONDUCTED |
| 0x16941 | 4558434c55534956454c592042592042 | EXCLUSIVELY BY B |
| 0x16951 | 494e44494e4720415242495452412054 | INDING ARBITRA T |
| 0x16961 | 494f4e2e20594f55204152450a313220 | ION. YOU ARE.12 |
| 0x16971 | 6d6f | mo |
Objectives
Micro-behaviors
Metadata
notable severity, 95% confident.
binary
PE has no signature record
Identity
| SHA-256 | 447a6efe71e6ade8bfaa100a0ad8c9563004c13c56d0d945f3483f77ab914844 |
|---|---|
| Filename | virussign.com_e65b9b93c9cff432693e3afa60022060.vir |
| Package | 447a6efe71e6ade8bfaa100a0ad8c9563004c13c56d0d945f3483f77ab914844 |
Origin
| Source | harvest |
|---|---|
| Feed | virussign |
| Domain | virussign.com |
Timeline
| First seen | 8 Aug 2026 14:42 UTC |
|---|---|
| First analyzed | 10 Aug 2026 08:15 UTC |
| Last analyzed | 10 Aug 2026 08:15 UTC |
| Last updated | 10 Aug 2026 08:15 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 73866 |
Not seeing what you expected? Let us know