AI
Phishing malware with persistence mechanisms
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₃(CaP₂As)H₆(Cm₂DbF₂Os₅Po₅U)Md₄(Bi₃Pt)Th
Card verification phishing resource set: virussign.com_41a0d5189ab84ecf098c466413e5b4a0.vir:0xab11
Shell service COM hijack persistence: virussign.com_41a0d5189ab84ecf098c466413e5b4a0.vir:0xb36c
ATM PIN prompt in PE resource: virussign.com_41a0d5189ab84ecf098c466413e5b4a0.vir:0xab11
| 0x3c0 | 00000000000000000000000000000000 | ................ |
| 0x3d0 | 00000000000000000000000000000000 | ................ |
| 0x3e0 | 00000000000000000000000000000000 | ................ |
| 0x3f0 | 00000000000000000000000000000000 | ................ |
| 0x400 | 76cc39af0b287dd306087f24470c0d2b | v.9..(}....$G..+ |
| 0x410 | cc485d2ccc585d34ce0ec127470c79e7 | .H],.X]4...'G.y. |
| 0x420 | 145a2eaf032869742df21124574c7940 | .Z...(it-..$WLy@ |
| 0x430 | b8397924470c1dad620c792447873d00 | .9y$G...b.y$G.=. |
| 0x440 | 6787212ccc7c75a7b9f30d047c785d00 | g.!,.|u.....|x]. |
| 0x450 | 3316f41031877597cc405d2ccc4475a7 | 3...1.u..@],.Du. |
| 0x460 | 3bbf7d2432db8670f40492f523837c24 | ;.}$2..p....#.|$ |
| 0x470 | 470c79a78300267a1ccf2cada25f2f73 | G.y...&z..,.._/s |
| 0x480 | 1266794e4764eb34070c86514fe4cf5e | .fyNGd.4...QO..^ |
| 0x490 | 470c247b1957f0c81acf8571cee9fac8 | G.${.W.....q.... |
| 0x4a0 | 4f5f2f7312872428cc497187cbbc | O_/s..$(.Iq... |
| 0x83c0 | 00000000000000000000000000000000 | ................ |
| 0x83d0 | 00000000000000000000000000000000 | ................ |
| 0x83e0 | 00000000000000000000000000000000 | ................ |
| 0x83f0 | 00000000000000000000000000000000 | ................ |
| 0x8400 | 88de1c3f38ed1e3f88ce5c3f884e5c3f | ...?8..?..\?.N\? |
| 0x8410 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8420 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8430 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8440 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8450 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8460 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8470 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8480 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0x8490 | 884e5c3fc3273258c32f2e4be720030e | .N\?.'2X./.K. .. |
| 0x84a0 | b84e | .N |
| 0xa9c4 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0xa9d4 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0xa9e4 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0xa9f4 | 884e5c3f884e5c3f884e5c3f884e5c3f | .N\?.N\?.N\?.N\? |
| 0xaa04 | dc26354ca8051968c46e0f6bdd081a1f | .&5L...h.n.k.... |
| 0xaa14 | ff2f2f1feb21385aec6e3e46a818721f | .//..!8Z.n>F..r. |
| 0xaa24 | de607c6fdd1e1776c6627c52e72a394d | .`|o...v.b|R.*9M |
| 0xaa34 | e93a334da8213a1feb3c294be73e7251 | .:3M.!:..<)K.>rQ |
| 0xaa44 | fd4e0b5ae42d3352ed6e2850a821294d | .N.Z.-3R.n(P.!)M |
| 0xaa54 | a828334dfd23701fc92a2953fc6e0b5a | .(3M.#p..*)S.n.Z |
| 0xaa64 | ea6e115efb3a394dfb6f7c57fc3a2c05 | .n.^.:9M.o|W.:,. |
| 0xaa74 | a7613f4dfd3a334fa620293fc9191113 | .a?M.:3O. )?.... |
| 0xaa84 | a8393953eb21315aa83a331fcb1c096b | .99S.!1Z.:3....k |
| 0xaa94 | c71e7271dd6e711fc00f0e7bcb010e7a | ..rq.nq....{...z |
| 0xaaa4 | a70d1371dc0b126ba70d1476c40a7c6f | ...q...k...v..|o |
| 0xaab4 | c71c1270a7021373c11a1d6ca71c1d6f | ...p...s...l...o |
| 0xaac4 | cd4e0e7ac9027c7cc91d1413a81c197e | .N.z..||.......~ |
| 0xaad4 | c46e1e76dc0d147ad26e711fcb1c096b | .n.v...z.nq....k |
| 0xaae4 | c71e7271dd4e5c3f884e1551eb212e4d | ..rq.N\?.N.Q.!.M |
| 0xaaf4 | ed2d281fc91a111fd8071213a83e305a | .-(..........>0Z |
| 0xab04 | e93d3913a82d334dfa2b3f4b881e305a | .=9..-3M.+?K..0ZCard verification phishing resource set |
| 0xab14 | e93d3913a82b324bed3c7c46e73b2e1f | .=9..+2K.<|F.;.. |
| 0xab24 | c91a111fd807123fc1203f50fa3c395c | .......?. ?P.<9\ |
| 0xab34 | fc6e1f69de7c7c17bb633856ef27281f | .n.i.||..c8V.'(. |
| 0xab44 | eb21385aa821321fea2f3f54a8213a1f | .!8Z.!2../?T.!:. |
| 0xab54 | eb2f2e5ba1627c4fe42b3d4ced627c5c | ./.[.b|O.+=L.b|\ |
| 0xab64 | e73c2e5aeb3a5c6fe42b3d4ced627c5a | .<.Z.:\o.+=L.b|ZCVV2 prompt in PE resource |
| 0xab74 | e63a394da837334afa6e1f69de7c7c17 | .:9M.73J.n.i.||. |
| 0xab84 | bb633856ef27281feb21385aa821321f | .c8V.'(..!8Z.!2. |
| 0xab94 | ea2f3f54a8213a1feb2f2e5ba14e794c | ./?T.!:../.[.NyL |
| 0xaba4 | a56b2f3fd822395efb2b701ffb2b305a | .k/?."9^.+p..+0Z |
| 0xabb4 | eb3a7c7af03e354de93a3550e66e055a | .:|z.>5M.:5P.n.Z |
| 0xabc4 | e93c5c6fe42b3d4ced627c4ced22395c | .<\o.+=L.b|L."9\ |
| 0xabd4 | fc6e1947f8272e5efc273351a8033351 | .n.G.'.^.'3Q..3Q |
| 0xabe4 | fc265c76e62d334dfa2b3f4ba80d3d4d | .&\v.-3M.+?K..=M |
| 0xabf4 | ec6e124ae52c394da46e2c53ed2f2f5a | .n.J.,9M.n,S.//Z |
| 0xac04 | a46e3f50fa3c395cfc4e0c53ed2f2f5a | .n?P.<9\.N.S.//ZCard number prompt in PE resource |
| 0xac14 | a46e3951fc2b2e1ff121294da80d3d4d | .n9Q.+...!)M..=M |
| 0xac24 | ec6e124ae52c394d886b2f1fad3d5c6f | .n.J.,9M.k/..=\o |
| 0xac34 | e42b3d4ced627c5ae63a394da82d334d | .+=L.b|Z.:9M.-3M |
| 0xac44 | fa2b3f4ba8082953e46e125ee52b5c6f | .+?K..)S.n.^.+\o |
| 0xac54 | e42b3d4ced627c4ced22395cfc6e1f5e | .+=L.b|L."9\.n.^ |
| 0xac64 | fa2a7c17de272f5ea7033d4cfc2b2e7c | .*|..'/^..=L.+.| |
| 0xac74 | e93c381688282e52ba4e0e5aef272f4b | .<8..(.R.N.Z.'/K |
| 0xac84 | ed3c0f5afa38355ced1e2e50eb2b2f4c | .<.Z.85\...P.+/L |
| 0xac94 | 8825394de62b300cba603853e44e2f4a | .%9M.+0..`8S.N/J |
| 0xaca4 | fa28725be93a5c5be6253711ec22303f | .(r[.:\[.%7.."0? |
| 0xacb4 | e3256f0da638245b8825370cba603853 | .%o..8$[.%7..`8S |
| 0xb061 | 6e7112b64e7611a24e0412e7250e5aeb | nq..Nv..N...%.Z. |
| 0xb071 | 386d0e88071979fa2f315a886b2f1afd | 8m....y./1Z.k/.. |
| 0xb081 | 6e711fc5273f4de73d3359fc6e1551fc | nq..'?M.=3Y.n.Q. |
| 0xb091 | 2b2e51ed3a7c7af03e3050fa2b2e3fd4 | +.Q.:|z.>0P.+.?. |
| 0xb0a1 | 073947f822334ded603947ed6e5c6fe9 | .9G."3M.`9G.n\o. |
| 0xb0b1 | 3a343fdb213a4bff2f2e5ad403355cfa | :4?.!:K./.Z..5\. |
| 0xb0c1 | 212f50ee3a0076cd6e0f5afc3b2c63db | !/P.:.v.n.Z.;,c. |
| 0xb0d1 | 2b284af84e255afb4e1e4de7392f5ac6 | +(J.N%Z.N.M.9/Z. |
| 0xb0e1 | 2b2b6ffa213f5afb3d5c11cc0b1a7edd | ++o.!?Z.=\....~. |
| 0xb0f1 | 020863db011a6bdf0f0e7ad403355cfa | ..c...k...z..5\. |
| 0xb101 | 212f50ee3a0068e1203850ff3d007cfd | !/P.:.h. 8P.=.|. |
| 0xb111 | 3c2e5ae63a0a5afa3d3550e6121947f8 | <.Z.:.Z.=5P...G. |
| 0xb121 | 22334ded3c007dfa212b4ced003948d8 | "3M.<.}.!+L..9H. |
| 0xb131 | 3c335ced3d2f3fcf22335de922094ced | <3\.=/?."3].".L. |
| 0xb141 | 3c1359ee223551ed4e0f50ee3a2b5efa | <.Y."5Q.N.P.:+^. |
| 0xb151 | 2b0072e12d2e50fb213a4bd4193551ec | +.r.-.P.!:K..5Q. |
| 0xb161 | 212b4cd40d294dfa2b324bde2b2e4ce1 | !+L..)M.+2K.+.L. |
| 0xb171 | 213263c120285afa20394ba81d394bfc | !2c. (Z. 9K..9K. |
| 0xb181 | 273258fb4e6d09b87f5c6cc7080868c9 | '2X.Nm...\l...h. |
| 0xb191 | 1c1963c5273f4de73d3359fc120b56e6 | ..c.'?M.=3Y...V. |
| 0xb1a1 | 2a3348fb121f4afa3c3951fc18394dfb | *3H...J.<9Q..9M. |
| 0xb1b1 | 273351d407324bed3c325afc6e0f5afc | '3Q..2K.<2Z.n.Z. |
| 0xb1c1 | 3a3551ef3d0065e720394cd46b293fb4 | :5Q.=.e. 9L.k)?. |
| 0xb1d1 | 613e50ec376203e03a3153b64e6010fb | a>P.7b..:1S.N`.. |
| 0xb1e1 | 2d2e56f83a623fad3d2f5afc1a3552ed | -.V.:b?.=/Z..5R. |
| 0xb1f1 | 21294ba06c2617a16c701afd67673ff5 | !)K.l&..lp..gg?. |
| 0xb201 | 4e794cec213f4ae52b324ba66b2f11fb | NyL.!?J.+2K.k/.. |
| 0xb211 | 3b3e52e13a7416b34e273fee3b325cfc | ;>R.:t..N'?.;2\. |
| 0xb221 | 273351a834741688722f5cfa272c4bb6 | '3Q.4t..r/\.',K. |
| 0xb231 | 4e6010ee212e52b64e6056e63e294ba8 | N`..!.R.N`V.>)K. |
| 0xb241 | 3a254fed737e4cfd2c3156fc6c7c49e9 | :%O.s~L.,1V.l|I. |
| 0xb251 | 22295ab5697b01886b2f438868325dfb | ")Z.i{..k/C.h2]. |
| 0xb261 | 3e673fad3d6056e63e294ba83a254fed | >g?.=`V.>)K.:%O. |
| 0xb271 | 737e5aec27281da8383d53fd2b6118ad | s~Z.'(..8=S.+a.. |
| 0xb281 | 3d7b1fe62f315ab569794cad3b7b01b4 | ={../1Z.iyL.;{.. |
| 0xb291 | 2c2e0185445c56ec4e794cb427324ffd | ,...D\V.NyL.'2O. |
| 0xb2a1 | 3a7c4bf13e3902aa2b3856fc6c7c49e9 | :|K.>9..+8V.l|I. |
| 0xb2b1 | 22295ab569794caf6e325ee52b6118ad | ")Z.iyL.n2^.+a.. |
| 0xb2c1 | 3d7b01b42c2e0185445c03ea3c623fad | ={..,...D\..<b?. |
| 0xb2d1 | 3d6059e73c311fe92d2856e720611dad | =`Y.<1..-(V. a.. |
| 0xb2e1 | 3d7e1fe52b2857e72a611dd8010f6baa | =~..+(W.*a....k. |
| 0xb2f1 | 6e325ee52b611dad3d7e0188287911bb | n2^.+a..=~..(y.. |
| 0xb301 | 3b5c03ea213846b64e6010e02b3d5bb6 | ;\..!8F.N`..+=[. |
| 0xb311 | 4e1156eb3c336ce7282812cb212e4f88 | N.V.<3l.((..!.O. |
| 0xb321 | 6b2f03fc272853ed70794cad3b6010fc | k/..'(S.pyL.;`.. |
| 0xb331 | 272853ed705c03e02b3d5bb64e794cb4 | '(S.p\..+=[.NyL. |
| 0xb341 | 6f7112a86b720dfd6e7112b64e6057fc | oq..kr..nq..N`W. |
| 0xb351 | 2330018860344be54e794cad2d795c88 | #0..`4K.NyL.-y\. |
| 0xc06a | 726f7957696e646f770056004d6f7665 | royWindow.V.Move |
| 0xc07a | 57696e646f77000000005b0044656657 | Window....[.DefW |
| 0xc08a | 696e646f7750726f6341000000005d00 | indowProcA....]. |
| 0xc09a | 43616c6c57696e646f7750726f634100 | CallWindowProcA. |
| 0xc0aa | 0000890047657453746f636b4f626a65 | ....GetStockObje |
| 0xc0ba | 637400000000ca00536574426b436f6c | ct......SetBkCol |
| 0xc0ca | 6f7200000000dd005365745465787443 | or......SetTextC |
| 0xc0da | 6f6c6f720000fa004372656174654272 | olor....CreateBr |
| 0xc0ea | 757368496e6469726563740000001c00 | ushIndirect..... |
| 0xc0fa | 437265617465466f6e74410000008700 | CreateFontA..... |
| 0xc10a | 476574557365724e616d654100007101 | GetUserNameA..q. |
| 0xc11a | 5265674372656174654b657945784100 | RegCreateKeyExA.Shell service COM hijack persistence |
| 0xc12a | 00007401526567436c6f73654b657900 | ..t.RegCloseKey. |
| 0xc13a | 000079015265674f70656e4b65794578 | ..y.RegOpenKeyEx |
| 0xc14a | 41008401526567517565727956616c75 | A...RegQueryValu |
| 0xc15a | 65457841000090015265675365745661 | eExA....RegSetVa |
| 0xc16a | 6c756545784100000000ca0147657453 | lueExA......GetS |
| 0xc17a | 65637572697479496e666f000000cd01 | ecurityInfo..... |
| 0xc18a | 5365745365637572697479496e666f00 | SetSecurityInfo. |
| 0xc19a | 0000d401536574456e7472696573496e | ....SetEntriesIn |
| 0xc1aa | 41636c41000018005f5f4765744d6169 | AclA....__GetMai |
| 0xc1ba | 6e417267730081015f736c6565700000 | nArgs..._sleep.. |
| 0xc1ca | 0000a6015f73747269636d700000fe01 | ...._stricmp.... |
| 0xc1da | 61746f6900000a026578697400005402 | atoi....exit..T. |
| 0xc1ea | 6d656d6370790000000056026d656d73 | memcpy....V.mems |
| 0xc1fa | 6574000000005b027072696e74660000 | et....[.printf.. |
| 0xc20a | 00006002726169736500610272616e64 | ..`.raise.a.rand |
| 0xc21a | 00006a027369676e616c000000006d | ..j.signal....m |
Objectives
Micro-behaviors
Metadata
notable severity, 95% confident.
binary
PE has no signature record
Third-party
notable severity, 90% confident.
SigBase/SUSP/Imphash
Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
20 of 28 traits shown
Identity
| SHA-256 | e9a00371d2939340e5eb1aaa9fa03a341c6c567f3da1b789fa8bb51f504bfc8c |
|---|---|
| Filename | virussign.com_41a0d5189ab84ecf098c466413e5b4a0.vir |
| Package | e9a00371d2939340e5eb1aaa9fa03a341c6c567f3da1b789fa8bb51f504bfc8c |
Origin
| Source | harvest |
|---|---|
| Feed | virussign |
| Domain | virussign.com |
Timeline
| First seen | 12 Aug 2026 13:04 UTC |
|---|---|
| First analyzed | 12 Aug 2026 17:27 UTC |
| Last analyzed | 12 Aug 2026 17:27 UTC |
| Last updated | 12 Aug 2026 17:27 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 73866 |
Not seeing what you expected? Let us know