- First seen
- Last seen
76DETECTION
Actor / APT signals DEMO Aurora (fictional) · 82% confidenceDEMO Lantern (fictional) · 61% confidence +1 more View context
Possible actor associations to support your investigation.
APT activity is flagged in the reported context.
- DEMO Aurora (fictional)
- 82% signal confidence
- DEMO Lantern (fictional)
- 61% signal confidence
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
0123456789abcdef0123456789abcdef0123456789abcdef0123456789ab0001- SHA1
0123456789abcdef0123456789abcdef01234567- MD5
0123456789abcdef0123456789abcdef- Filename
- demo-loader.exe
- File type
- PE32 executable
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 245760
- Compile time
- 2026-09-03T11:24:00Z
- PE platform
- x86 / PE32
- PE sections
- 6
Connected context
Drag to move or rotate · Select a node for details
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 11. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 76%.
Confidence signal
VirusSign reports 92% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections76%
VirusSign confidence92%
Relationship context11 visible
Threat classificationDemoBeacon
Explore connected indicators, pivot through relationships, and trace multi-hop paths.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related IPs
Network IPs associated with this indicator.
3shown
203.0.113.30
76%
high
JP
ASN
AS64500
AS owner
Example infrastructure (fictional)
Country
JP
First seen
2026-09-13T08:00:00Z
Last seen
2026-09-24T16:00:00Z
198.51.100.20
76%
high
DE
ASN
AS64500
AS owner
Example infrastructure (fictional)
Country
DE
First seen
2026-09-10T08:00:00Z
Last seen
2026-09-24T16:00:00Z
192.0.2.10
76%
high
US
ASN
AS64500
AS owner
Example infrastructure (fictional)
Country
US
First seen
2026-09-07T08:00:00Z
Last seen
2026-09-24T16:00:00Z
Related domains
Domains associated with this indicator.
4shown
relay.demo.example
76%
high
First seen
2026-09-05T08:00:00Z
Last seen
2026-09-24T16:00:00Z
gateway.demo.example
76%
high
First seen
2026-09-13T08:00:00Z
Last seen
2026-09-24T16:00:00Z
assets.demo.example
76%
high
First seen
2026-09-11T08:00:00Z
Last seen
2026-09-24T16:00:00Z
update.demo.example
76%
high
First seen
2026-09-09T08:00:00Z
Last seen
2026-09-24T16:00:00Z
Related URLs
URLs associated with this indicator.
3shown
https://relay.demo.example/download
76%
high
First seen
2026-09-16T08:00:00Z
Last seen
2026-09-24T16:00:00Z
https://relay.demo.example/config
76%
high
First seen
2026-09-14T08:00:00Z
Last seen
2026-09-24T16:00:00Z
https://relay.demo.example/check-in
76%
high
First seen
2026-09-12T08:00:00Z
Last seen
2026-09-24T16:00:00Z
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
1shown
0123456789abcdef0123456789abcdef0123456789abcdef0123456789ab0002
76%
high
PE32 executable
311296 bytes
Filename
demo-agent.dll
Family
DemoBeacon
Type
Trojan
File type
PE32 executable
Size
311296
Analysis details
Severity: highactor:demo-aurora-fictionalactor:demo-lantern-fictionalapttrojandemonstrationexecutiondiscoveryfile_activityanalysis_evasionpersistencesigned
Freshness: Fictional example · Fixed sample observations, not live intelligence.
- Detection rate
- 76%
- Threat type
- Trojan
- Family
- DemoBeacon
- Confidence
- 92%
- detection
- 76 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
0123456789abcdef0123456789abcdef0123456789abcdef0123456789ab0001- SHA1
0123456789abcdef0123456789abcdef01234567- MD5
0123456789abcdef0123456789abcdef- Filename
- demo-loader.exe
- File type
- PE32 executable
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 245760
- Compile time
- 2026-09-03T11:24:00Z
- PE platform
- x86 / PE32
- PE sections
- 6
- Import libraries
- 5
- TLSH
T10123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF012345- SSDEEP
3072:DEMOdemoDEMOdemoDEMOdemoDEMOdemoDEMOdemoDEMOdemo:DEMOdemoDEMOdemoDEMOdemo- Imphash
abcdef0123456789abcdef0123456789- First seen
- 2026-09-05T08:00:00Z
- Last seen
- 2026-09-24T16:00:00Z
- Actor context
- demo-aurora-fictional · 82%
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 11. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 76%.
Confidence signal
VirusSign reports 92% confidence. Review this alongside engine detections and relationship evidence.
Actor context
Actor context is present for DEMO Aurora (fictional) with high confidence.
Threat context
Classification includes type Trojan and family DemoBeacon.
Relationship context
11 related indicators are shown across 4 relationship group(s).
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type Trojan, family DemoBeacon.
High confidence. Possible association for investigation.
Last seen 26 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- demo-loader.exe
- File type
- PE32 executable
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 245760
- Compile time
- 2026-09-03T11:24:00Z
- PE platform
- x86 / PE32
- Entry point
- 0x00001200
- Sections
- 6
Detection highlights
summarySelected engine verdicts.
- DEMO StaticDemoBeacon.Loader (fictional)
- DEMO BehaviorCommand execution and discovery (fictional)
- DEMO HeuristicsSuspicious packed loader (fictional)
- DEMO NetworkBeacon-like communication (fictional)
- DEMO ReputationFictional campaign association
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings. Up to 5 entries per detail group.
View MITRE ATT&CK details · 5 shown
5 mappings
-
T1059.003 — Windows command shell execution (fictional demo)
Tactics: TA0002
-
T1082 — System information discovery (fictional demo)
Tactics: TA0007
-
T1083 — File and directory discovery (fictional demo)
Tactics: TA0007
-
T1105 — Ingress tool transfer (fictional demo)
Tactics: TA0011
-
T1027 — Obfuscated files or information (fictional demo)
Tactics: TA0005
View MBC details · 5 shown
5 mappings
- B0001 — Debugger detection (fictional demo)
- B0002 — Debugger evasion (fictional demo)
- B0003 — Dynamic analysis evasion (fictional demo)
-
E1083 — File and directory discovery (fictional demo)
Objectives: OB0007
-
E1082 — System information discovery (fictional demo)
Objectives: OB0007
Network activity
summarySummary of observed network activity. More details and additional structured data are available through API and data access.
Network activity5+
HTTPS, HTTPports 443, 80, 8443
- 5+ outbound connections observed
- 4 domains, 3 IPs, 5+ URLs
- Common ports: 443, 80, 8443
- Protocols: HTTPS, HTTP
- Top countries: CA, US, DE
- First observed: 2026-09-24
C2 candidates3
HTTPSports 443, 8443
- 3 C2 candidate communications
- 3 domains, 2 IPs
- Common ports: 443, 8443
- Protocols: HTTPS
- Top countries: US, CA
- First observed: 2026-09-20
- Last observed: 2026-09-24
Infrastructure summary
summarySummary of related infrastructure. More details and additional structured data are available through API and data access.
Service discovery3
ports 443, 80, 8443TCP
- 3 service observations
- Common ports: 443, 80, 8443
- Protocols: TCP
- Services: DEMO Alternate HTTPS, DEMO HTTP asset service, DEMO HTTPS relay
File structure summary
summaryFile structure summary based on available metadata. More details and additional structured data are available through API and data access.
PE header1
platform x86 / PE325+ sections
- Platform: x86 / PE32
- Sections: 5+
- Entry point: present
- Compile time: 2026-09-03T11:24:00Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: R--, RW-, R-X
- 5+ unique section names
Imports5
5 DLL groups
- 5 import DLL groups
- 5+ imported functions summarized
Exports2
2 exported items
- 2 exported items
Resources3
3 resources
- 3 resources
- Resource types: ICON, MANIFEST, VERSION
File certificate summary
summaryFile certificate summary based on available metadata. More details and additional structured data are available through API and data access.
Certificates1
1 issuer
- Example subject: CN=DEMO Software Publisher (fictional)
- Issued by: CN=DEMO Signing Authority (fictional)
- Validity period (UTC): 2026-01-01 – 2027-01-01
Structured data
Fictional sample JSON. Do not use as operational threat intelligence.