Suspicious ^80% Download

virussign.com_80e81d95fc34c73489bef47a873e1f70.vir

Process injection and evasion APIs

PE manifest requests adminToolhelp process termination API cluster

SHA-25607555d076f2882d6ee64a23e6172e3ab4cbe60bedb33c665d6e6c814912fcc57

URLhttp://samples.virussign.com/samples/virussign.com_20260930_LimitedFree.zip

MaleculeO₄(As₂CDy₂Er₃)H₁₀(Cm₂CrDb₂F₂HfMg₃Os₈Po₁₁TiU)Md₃(Bi₃BkSi)

Evidence

Vectorized zero-fill instruction sequence 0xfd0–0x1280

⋯33 more rows
0x11e08390030000480355d04889c1488dbec8.....H.U.H..H...
0x11f0010000488b45f8ffd00f57c00f110748...H.E....W....H
0x1200c7471000000000488b8eb00100004885.G.....H......H.
0x1210c97447488b96c00100004829ca483b55.tGH......H).H;U
⋯7 more rows

Immediate process-information class value 30 0x1b8d–0x1c4d

⋯3 more rows
0x1bbd85af0100008bbd94010000b93f000000............?...
0x1bcdba1e0000000f44d14c8d05441e1b0048......D.L..D...H
0x1bdd8d0c1249030cd049be466ec11a1c9194...I...I.Fn.....
⋯7 more rows

Immediate process-information class value 31 0xded3–0xdf93

⋯3 more rows
0xdf03a8ffd0488b4d00483b4d08b8c0000000...H.M.H;M......
0xdf13ba1f000000480f47d0498b04d64801d0.....H.G.I...H..
0xdf234801f848c1c01f4829d0488b04c34c01H..H...H).H...L.
⋯7 more rows

x64 imm64 pointer add then jmp rax 0x166db–0x167ab

⋯3 more rows
0x1670b01f94831c1488d05e99e2100488b04c8..H1.H....!.H...
0x1671b48b9ad189ad686f037f24801c8ffe04cH.......7.H....L
0x1672b8b9d18180000498b731048b84f8b1919......I.s.H.O...
0x1673b4c3abbca480305ca0d1a004839c6b8d7L:..H......H9...
⋯7 more rows

Dense x64 TLS-array pointer access 0x4f635–0x4f6f5

⋯3 more rows
0x4f665488945e8488b45d88b008b0d3f612500H.E.H.E.....?a%.
0x4f67565488b142558000000488b0cca3b8104eH..%X...H...;..
0x4f685000000b851000000b929000000480f4f....Q....)...H.O
⋯7 more rows