AI
Packed PE loader with dynamic API resolution
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₂(AsC)H₃(CmMgOs)Md₂(Bi₅)
UPX decompression failed: IO error: No such file or directory (os error 2): virussign.com_e339ab3e18106287c9e810daa05a3d60.vir
Packed PE loader with writable entry and dynamic API resolution: virussign.com_e339ab3e18106287c9e810daa05a3d60.vir:0x0
Binary contains a UPX packing marker: virussign.com_e339ab3e18106287c9e810daa05a3d60.vir
| 0x0 | 4d5a90000300000004000000ffff0000 | MZ..............Packed PE loader with writable entry and dynamic API resolution |
| 0x10 | b8000000000000004000000000000000 | ........@....... |
| 0x20 | 00000000000000000000000000000000 | ................ |
| 0x30 | 000000000000000000000000f0000000 | ................ |
| 0x40 | 0e1fba0e00b409cd21b8014ccd215468 | ........!..L.!Th |
| 0x50 | 69732070726f6772616d2063616e6e6f | is program canno |
| 0x60 | 742062652072756e20696e20444f5320 | t be run in DOS |
| 0x70 | 6d6f64652e0d0d0a2400000000000000 | mode....$....... |
| 0x80 | f16fd3c7b50ebd94b50ebd94b50ebd94 | .o.............. |
| 0x90 | ce12b194b60ebd943612b394b70ebd94 | ........6....... |
| 0xa0 | 5d11b794be0ebd945d11b994b70ebd94 | ].......]....... |
| 0xb0 | 5d11b694b60ebd94b50ebc94d00ebd94 | ]............... |
| 0xc0 | 7601e094bc0ebd945d11ab94b40ebd94 | v.......]....... |
| 0xd0 | 52696368b50ebd940000000000000000 | Rich............ |
| 0xe0 | 00000000000000000000000000000000 | ................ |
| 0xf0 | 504500004c0103007ee5e74700000000 | PE..L...~..G.... |
| 0x100 | 00000000e0000f010b01060000400000 | .............@.. |
| 0x110 | 0010000000a0020030e2020000b00200 | ........0....... |
| 0x120 | 00f002000000400000 | ......@.. |
| 0x3c0 | 00000000000000000000000000000000 | ................ |
| 0x3d0 | 0000000000000000000000332e303200 | ...........3.02. |
| 0x3e0 | 555058210d0902088355811675cdb8e9 | UPX!.....U..u... |
| 0x3f0 | 76c50200233200000066000000000088 | v...#2...f...... |
| 0x400 | a1002a9000460154208c02a840190550 | ..*..F.T ...@..PEmpty RWX UPX0 decoy section |
| 0x410 | 81320aa00264144005c828800a905100 | .2...d.@..(...Q. |
| 0x420 | 1520a3002a40460154818c02a8021905 | . ..*@F.T....... |
| 0x430 | 5005320aa00a64144050d92880035936 | P.2...d.@P.(..Y6 |
| 0x440 | 7f50d1874200fb258855b36c9aa685b5 | .P..B..%.U.l.... |
| 0x450 | e51589456ed3344d75a5dcff228a17cc | ...En.4Mu..."... |
| 0x460 | b2597603b893e110943f7bb93dc200ec | .Yv......?{.=... |
| 0x470 | 761b0427487742036797cd7f5f950506 | v..'HwB.g..._... |
| 0x480 | 05050501fafabd050045ffefae9205dd | .........E...... |
| 0x490 | 040b1abf0b05b10cc824 | .........$ |
| 0x3897 | 0000000000c8000080000000004cf102 | .............L.. |
| 0x38a7 | 000000000074000080000000004b4552 | .....t.......KER |
| 0x38b7 | 4e454c33322e444c4c004d5356435254 | NEL32.DLL.MSVCRT |
| 0x38c7 | 2e646c6c004f4c4541555433322e646c | .dll.OLEAUT32.dl |
| 0x38d7 | 6c005553455233322e646c6c00575332 | l.USER32.dll.WS2 |
| 0x38e7 | 5f33322e646c6c00004c6f61644c6962 | _32.dll..LoadLib |
| 0x38f7 | 7261727941000047657450726f634164 | raryA..GetProcAd |
| 0x3907 | 647265737300005669727475616c5072 | dress..VirtualPr |
| 0x3917 | 6f7465637400005669727475616c416c | otect..VirtualAl |
| 0x3927 | 6c6f6300005669727475616c46726565 | loc..VirtualFree |
| 0x3937 | 0000004578697450726f636573730000 | ...ExitProcess.. |
| 0x3947 | 0061746f69000077737072696e746641 | .atoi..wsprintfA |
| 0x3957 | 00000000000000000000000000000000 | ................ |
| 0x3967 | 00000000000000 | ....... |
| 0x39c0 | 00000000000000000000000000000000 | ................ |
| 0x39d0 | 00000000000000000000000000000000 | ................ |
| 0x39e0 | 00000000000000000000000000000000 | ................ |
| 0x39f0 | 00000000000000000000000000000000 | ................ |
| 0x3a00 | 214788b56649b8f5c6fcf35264fba49b | !G..fI.....Rd... |
| 0x3a10 | 590c7e5dc8374e482a3b2865bc821c59 | Y.~].7NH*;(e...Y |
| 0x3a20 | 57fc37b08e04e201602d0761d12a7103 | W.7.....`-.a.*q. |
| 0x3a30 | 4b21dce1071cb659df7dd7a76382f493 | K!.....Y.}..c... |
| 0x3a40 | 6a67e64499988412928254c23911238f | jg.D......T.9.#. |
| 0x3a50 | 4438e25c1dca59fba257f5f5ead86a9d | D8.\..Y..W....j. |
| 0x3a60 | 90814cf022515c1148634b4db7f5828e | ..L."Q\.HcKM.... |
| 0x3a70 | 7fc65699c7a726801e6b41afd1a6b570 | ..V...&..kA....p |
| 0x3a80 | 07b5c04e87af8b3c6da77bebaed93820 | ...N...<m.{...8 |
| 0x3a90 | b8b123770d0acbef0d4c1e4a5a437355 | ..#w.....L.JZCsU |
| 0x3aa0 | 0de641826f6616a0f19f9d9cc36954b8 | ..A.of.......iT. |
| 0x3ab0 | b356586aa9856e1cfb8314cd0eb8a26c | .VXj..n........l |
| 0x3ac0 | 65696e4d42dbe7254b0c8a71df8b48a1 | einMB..%K..q..H. |
| 0x3ad0 | b401a7f8b1d63e79c88b4fd536c528a7 | ......>y..O.6.(. |
| 0x3ae0 | d8068efeaaadcc7e71a3bf10afd8eaf7 | .......~q....... |
| 0x3af0 | 84f6e83f6ef3dcc920d49f1261dbcc4d | ...?n... ...a..M |
| 0x3b00 | 327a08fb1aa976b9618fdfb4241bf42c | 2z....v.a...$.., |
| 0x3b10 | f2ee16ea74472e8041437848e4a3bd78 | ....tG..ACxH...x |
| 0x3b20 | c1f7e8bf43547a361c6faf2bf2d50783 | ....CTz6.o.+.... |
| 0x3b30 | d092cf4098eefae76eaf72cfd5760d0a | ...@....n.r..v.. |
| 0x3b40 | 985a2363d520e4d1a8a5531b57163ca2 | .Z#c. ....S.W.<. |
| 0x3b50 | 1572025796743b6c1f6e65c816116227 | .r.W.t;l.ne...b' |
| 0x3b60 | 7054144adfebc65a1886c2ad2ec937af | pT.J...Z......7. |
| 0x3b70 | cfb3d094d9673214968b25dc1a352beb | .....g2...%..5+. |
| 0x3b80 | 968bd81893a698d4604c379abb0f6275 | ........`L7...bu |
| 0x3b90 | f270849188928d649395a1b0efa44696 | .p.....d......F. |
| 0x3ba0 | 745f736839933067b1071e389caa8f24 | t_sh9.0g...8...$ |
| 0x3bb0 | 948b197e36dcbab3b1de04ecc0875e47 | ...~6.........^G |
| 0x3bc0 | ca32d57d30bc131b8f4bda7e84a6434e | .2.}0....K.~..CN |
| 0x3bd0 | 9c69fd2d09efda3f5d3d685ec8c7d101 | .i.-...?]=h^.... |
| 0x3be0 | 2c6d6cbbe6ed7d5ed032420e395035e9 | ,ml...}^.2B.9P5. |
| 0x3bf0 | c7f49494bd3a44a5580b5df25816b4ad | .....:D.X.].X... |
| 0x3c00 | 7e7c12abe436df8023d71f2694b7d152 | ~|...6..#..&...R |
| 0x3c10 | a79bb54f236ee93929e8c0d365cb97fb | ...O#n.9)...e... |
| 0x3c20 | 4f197ac2eadb38055d2fae85323a4420 | O.z...8.]/..2:D |
| 0x3c30 | 4e2b9d9c81ca74e877827e336b13f135 | N+....t.w.~3k..5 |
| 0x3c40 | 57c5f7ada34b20cae7a4308d5bc2e3e9 | W....K ...0.[... |
| 0x3c50 | 82b561a1ae178f265f15870224b7d00b | ..a....&_...$... |
| 0x3c60 | 8f519a663cb6b39b9ea459430df3b513 | .Q.f<.....YC.... |
| 0x3c70 | 3406a13cf28aea0248815d61ce9c2ab5 | 4..<....H.]a..*. |
| 0x3c80 | f0e77cc2d4dfd3f2afca7c51690d0a26 | ..|.......|Qi..& |
| 0x3c90 | f95dc4890d917e9a62249b2385eed75c | .]....~.b$.#...\ |
| 0x3ca0 | bf7bac572d52b948a24a238ef556f582 | .{.W-R.H.J#..V.. |
| 0x3cb0 | d6838b67c68f011501e3ac20374bb5a6 | ...g....... 7K.. |
| 0x2eff8 | f1da49838193596f1550333b08d9bcbd | ..I...Yo.P3;.... |
| 0x2f008 | f0d31e82724ee3e427ac9cd5aff8ad66 | ....rN..'......f |
| 0x2f018 | dcf4671493842115ce3cd87f5d2e1b9d | ..g...!..<..]... |
| 0x2f028 | c846c149884c4017d9d70933f25cccb0 | .F.I.L@....3.\.. |
| 0x2f038 | 628b9bbbd0aa26e2f3be2be0f14836fa | b.....&...+..H6. |
| 0x2f048 | 8e42e657657b1f3a5fa2bd9278dedc1c | .B.We{.:_...x... |
| 0x2f058 | 78f5ec80cb3e7648adcd12cc5c3f3b96 | x....>vH....\?;. |
| 0x2f068 | 9977ef410f53de48ea968bee49869d93 | .w.A.S.H....I... |
| 0x2f078 | 3c1a5c238d1373837f7b8a2933cddd22 | <.\#..s..{.)3.."Packed PE loader with writable entry and dynamic API resolution |
| 0x2f088 | 77cf3cde24dbba74c327759d333da849 | w.<.$..t.'u.3=.I |
| 0x2f098 | 793e85e7fb227fd2517d857359975695 | y>..."..Q}.sY.V. |
| 0x2f0a8 | 5d4be87cdffd9aa5572b1966fa4f362f | ]K.|....W+.f.O6/ |
| 0x2f0b8 | 762f2535863d46d4e2b581518614605f | v/%5.=F....Q..`_ |
| 0x2f0c8 | a401559765f36cb5b68c5645ccdf05ab | ..U.e.l...VE.... |
| 0x2f0d8 | 9ecabe24010b751e9798c296570d3c5f | ...$..u.....W.<_ |
| 0x2f0e8 | 4918a566b9cf1ff2994ad36c3660d51b | I..f.....J.l6`.. |
| 0x2f0f8 | 81059782a184c03777ad4f4fcc20ac6a | .......7w.OO. .j |
| 0x2f108 | ec4f414d46f2a81e5976fabda81d6fcb | .OAMF...Yv....o. |
| 0x2f118 | 50653ad204f7de1aae12f2394bc2f849 | Pe:........9K..I |
| 0x2f128 | 55f6d66ad61601edf336f6d4fbaf1b81 | U..j.....6...... |
| 0x2f138 | e20775c82806893a8c743c471ab9eeba | ..u.(..:.t<G.... |
| 0x2f148 | 6975d28c1f45258d8ac5ba7b6a0926f1 | iu...E%....{j.&. |
| 0x2f158 | b318d9cf72a6f8859afe2066a15c6e37 | ....r..... f.\n7 |
| 0x2f168 | 436d37b3609599e3717ab491f0e2c9e2 | Cm7.`...qz...... |
| 0x2f178 | 5d3e83a721842f31dc521ec1 | ]>..!./1.R.. |
Objectives
Micro-behaviors
Metadata
anti-static
hostile severity, 100% confident.
packer/upx
UPX decompression failed: IO error: No such file or directory (os error 2)
suspicious severity, 100% confident.
packer
Binary contains a UPX packing marker
Identity
| SHA-256 | 655caa869735f93b0d43e6b1f35574ceb889b6440ce742af3b44938c75a2a15f |
|---|---|
| Filename | virussign.com_e339ab3e18106287c9e810daa05a3d60.vir |
| Package | 655caa869735f93b0d43e6b1f35574ceb889b6440ce742af3b44938c75a2a15f |
Origin
| Source | harvest |
|---|---|
| Feed | virussign |
| Domain | virussign.com |
Timeline
| First seen | 2 Aug 2026 13:18 UTC |
|---|---|
| First analyzed | 2 Aug 2026 14:03 UTC |
| Last analyzed | 2 Aug 2026 14:03 UTC |
| Last updated | 2 Aug 2026 14:03 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | c795d |
Not seeing what you expected? Let us know