valkyrie logo
valkyrie logo
  • Download Threat Hunter Assessment Tool
DASHBOARD
  • Unknown File Hunter Scans
STATISTICS
SETTINGS
  • Summary
  • Static Analysis
  • Dynamic Analysis
  • Precise Detectors
  • Human Expert Analysis
  • File Details
Analyzing...
File Name:   virussign.com_3e1486816297f6d58cf3363be9a5af2e.exe
SHA1:   8a3a457ada559fd46c4cfefa2ec0b69fd085c2f1
MD5:   3e1486816297f6d58cf3363be9a5af2e
First Seen Date:  2026-04-03 22:09:38.681137 ( 2026-04-03 22:09:38.681137 )
Number of Clients Seen:   4
Last Analysis Date:  2026-04-05 11:03:21.327768 ( 2026-04-05 11:03:21.327768 )
Human Expert Analysis Date:  2026-04-04 19:52:52.697923 ( 2026-04-04 19:52:52.697923 )
Human Expert Analysis Result:   Clean

Analysis Summary

Analysis Type Date Verdict
Signature Based Detection 2026-04-05 11:03:21.327768 Clean
Static Analysis Overall Verdict 2026-04-05 11:03:21.327768 No Threat Found help
Dynamic Analysis Overall Verdict 2026-04-05 11:03:21.327768 No Threat Found help
Precise Detectors Overall Verdict 2026-04-05 11:03:21.327768 No Match help
Human Expert Analysis Overall Verdict 2026-04-04 19:52:52.697923 Clean

Static Analysis

Static Analysis Overall Verdict Result
No Threat Found help
Detector Result
Optional Header LoaderFlags field is valued illegal Clean
Non-ascii or empty section names detected Clean
Illegal size of optional Header Clean
Packer detection on signature database Unknown help
Based on the sections entropy check! file is possibly packed Clean
Timestamp value suspicious Clean
Header Checksum is zero! Suspicious
Enrty point is outside the 1st(.code) section! Binary is possibly packed Clean
Optional Header NumberOfRvaAndSizes field is valued illegal Clean
Anti-vm present Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger Suspicious
TLS callback functions array detected Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict Result
No Threat Found help
Suspicious Behaviors
Creates a child process
Reads memory of another process
Writes to address space of another process
Uses a function clandestinely
Downloads data from internet
Opens a file in a system directory
Has no visible windows

virussign.com_3e1486816297f6d58cf3363be9a5af2e.exe tried to connect to some addresses pinned on the map below (click pins for more details):

Behavioral Information

LoadLibrary

SHFOLDER

ole32.dll

comctl32.dll

ADVAPI32.dll

propsys.dll

ntmarta.dll

SHELL32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\System.dll

RichEd20

UxTheme.dll

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\ShutdownAllow.dll

IMM32.dll

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\inetc.dll

imageres.dll

Secur32.dll

api-ms-win-downlevel-advapi32-l2-1-0.dll

api-ms-win-downlevel-ole32-l1-1-0.dll

WS2_32.dll

winhttp.dll

wininet.dll

API-MS-Win-Security-LSALookup-L1-1-0.dll

IPHLPAPI.DLL

CRYPTBASE.dll

api-ms-win-downlevel-shlwapi-l2-1-0.dll

RASAPI32.dll

shlwapi.dll

DNSAPI.dll

OLEAUT32.dll

dhcpcsvc.DLL

urlmon.dll

Comctl32.dll

C:\Windows\system32\ws2_32

CreateMutex

<NULL>

t 'YesMessenger'

YesMessenger

RasPbFile

Local\ZonesCacheCounterMutex

Local\ZonesLockedCacheCounterMutex

InternetDownload

cc000c

ReadFile

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000010.db

C:\Users\desktop.ini

C:\Users\win7\Desktop\desktop.ini

C:\[uvirussign.com_3e1486816297f6d58cf3363be9a5af2e.exe]

DeleteFile

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\header-install.bmp

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\inetc.dll

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\InstallationType

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\modern-header.bmp

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\ShutdownAllow.dll

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\System.dll

WriteFile

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\header-install.bmp

C:\Users\win7\AppData\Local\YesMessenger\paraminstall.spec

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\ShutdownAllow.dll

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\inetc.dll

C:\[uvirussign.com_3e1486816297f6d58cf3363be9a5af2e.exe]

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\InstallationType

C:\Users\win7\AppData\Local\YesMessenger\cancel.url

\\.\Nsi

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\modern-header.bmp

C:\Windows\system32\rsaenh.dll

C:\Users\win7\AppData\Local\Temp\YesMessenger-full-installer-sign.exe

C:\Users\win7\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\80ELSUJ6\YesMessengersetup[1].exe

CreateProcess

C:\Users\win7\AppData\Local\Temp\YesMessenger-full-installer-sign.exe

QueryFilePath

C:\Users\win7\AppData\Local\Temp\YesMessenger-full-installer-sign.exe

C:\[uvirussign.com_3e1486816297f6d58cf3363be9a5af2e.exe]

C:\Windows\system32\RichEd20.DLL

C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90.dll

C:\Users\win7\AppData\Local\Temp\nsi6CB6.tmp\inetc.dll

OpenRegistryKey

\REGISTRY\MACHINE\SYSTEM\Setup

\REGISTRY\USER\.DEFAULT\SOFTWARE\Microso

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache

CreateRegistryKey

\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{69DC4768-446B-4F82-A6B0-63966A243064}\52-54-00-12-35-02

Precise Detectors Analysis Results

Detector Name Date Verdict Reason
Static Precise PUA Detector 1 2026-04-05 11:03:12.299323 No Match help NotDetected
Static Precise PUA Detector 4 2026-04-05 11:03:12.338644 No Match help NotDetected
Static Precise NI Detector 3 2026-04-05 11:03:12.530136 No Match help NotDetected
Static Precise PUA Detector 5 2026-04-05 11:03:12.530446 No Match help NotDetected
Static Precise Trojan Detector 1 2026-04-05 11:03:12.570487 No Match help NotDetected
Static Precise Trojan Detector 3 2026-04-05 11:03:12.578572 No Match help NotDetected
Static Precise PUA Detector 6 2026-04-05 11:03:12.615612 No Match help NotDetected
Static Precise Trojan Detector 12 2026-04-05 11:03:12.544432 No Match help NotDetected
Static Precise Virus Detector 1 2026-04-05 11:03:12.643646 No Match help NotDetected
Static Precise Virus Detector 2 2026-04-05 11:03:12.617468 No Match help NotDetected
Static Precise NI Detector 1 2026-04-05 11:03:12.632837 No Match help NotDetected
Static Precise NI Detector 2 2026-04-05 11:03:12.652788 No Match help NotDetected
Static Precise Trojan Detector 13 2026-04-05 11:03:12.666323 No Match help NotDetected
Static Precise PUA Detector 2 2026-04-05 11:03:12.666088 No Match help NotDetected

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Detector Result

Human Expert Analysis Results

Analysis Start Date:   2026-04-04 14:50:24.352567 ( 2026-04-04 14:50:24.352567 )
Analysis End Date:  2026-04-04 19:52:52.697923 ( 2026-04-04 19:52:52.697923 )
File Upload Date:  2026-04-03 22:08:20.564976 ( 2026-04-03 22:08:20.564976 )
Update Date:  2026-04-04 19:54:19.938623 ( 2026-04-04 19:54:19.938623 )
Human Expert Analyst Feedback:   None
Verdict:   Clean

Additional File Information

Vendor Validation

Certificate Validation

PE Headers

Property Value

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy MD5

PE Imports

PE Exports

PE Resources

© Verdict Cloud, Xcitium, Inc. 2026. All rights reserved. v1.49.0-72-ENT
 
 
 
 
Loading...