- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- Domain
- files.catbox.moe
- TLD
- moe
- Root domain
- catbox.moe
- Subdomain
- files
- Resolved geo
- Los Angeles, California, United States
- Resolved IP
- 108.181.20.43
- Country
- United States
- DGA risk
- low
- DGA score
- 30.0
- Domain age days
- 4239.0
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 60%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections10%
VirusSign confidence60%
Relationship context15 visible
Threat classificationmalware
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related files
Files observed communicating with, containing, or otherwise linked to this indicator.
5shown
70%
critical
peexe
856064 bytes
communicates
Filename
b3b5687c_scanned_file00000768 ship docs & inv#493.exe.bin
Family
dynamer
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
83%
high
peexe
960512 bytes
communicates
Filename
25b252ac_views.exe.bin
Family
luminositylink
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
74%
critical
peexe
2034176 bytes
communicates
Filename
9520f781_c20d8d900ed949e380fe252571abcd38.virus.bin
Family
nanocore
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
70%
high
peexe
1293312 bytes
communicates
Filename
9faa484c_scan file pdf .exe.bin
Family
omaneat
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
75%
high
peexe
778240 bytes
communicates
Filename
8a2f771f_emirates nbd documents.jpeg.exe_.bin
Family
omaneat
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Related domains
Domains associated with this indicator.
5shown
5%
low
.moe
siblings
Root
catbox.moe
TLD
moe
Subdomain
www
First seen
2025-11-30T04:54:58Z
Last seen
2025-11-30T04:54:58Z
.moe
siblings
Root
catbox.moe
TLD
moe
Subdomain
tenkai
First seen
2026-03-25T10:19:10Z
Last seen
2026-04-18T01:12:37Z
0%
.moe
siblings
Root
catbox.moe
TLD
moe
Subdomain
store
First seen
2026-03-25T10:19:10Z
Last seen
2026-04-22T07:10:39Z
0%
.moe
siblings
Root
catbox.moe
TLD
moe
Subdomain
status
First seen
2026-03-25T10:19:10Z
Last seen
2026-04-22T07:10:39Z
5%
medium
.moe
siblings
Root
catbox.moe
TLD
moe
Subdomain
sg
First seen
2026-03-13T17:56:32Z
Last seen
2026-03-13T17:56:32Z
Related URLs
URLs associated with this indicator.
5shown
4%
low
contains
TLD
moe
HTTP status
200
Content length
1572864
Content SHA256
117abb8b2b6855d55549e046f032aaa58ffd0425770325aa5b70aaa8852d99f6
First seen
2025-11-10T15:30:33Z
4%
low
contains
TLD
moe
HTTP status
200
Content length
755216
Content SHA256
d64266a7d0ff3aa9518da04280402aa2e2843d125302d4c4546baad06130a364
First seen
2023-08-20T23:01:00Z
4%
low
contains
TLD
moe
HTTP status
200
Content length
44033
Content SHA256
61bcd0ed8177b92d0a156bcce46489520a57000a754de66bfc60b64318b35024
First seen
2025-11-07T18:04:01Z
17%
medium
contains
TLD
moe
HTTP status
503
Content length
15
Content SHA256
327972b8bcc43d2ebdb6ad8c96d5d5312f0f73328ca8211195d757ef5f0e5116
First seen
2025-04-23T20:19:13Z
4%
low
contains
TLD
moe
HTTP status
200
Content length
4119378
Content SHA256
15b4f44b97b1817ead7de67fd6a0f5d6b05bc71e1990358826f42d1d1db7ef71
First seen
2025-11-06T04:13:35Z
Analysis details
Severity: mediummalware
Freshness: Fresh · Last seen today.
- Detection rate
- 10%
- Threat type
- malware
- Confidence
- 60%
- detection
- 10 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- Domain
- files.catbox.moe
- TLD
- moe
- Root domain
- catbox.moe
- Subdomain
- files
- Resolved geo
- Los Angeles, California, United States
- Resolved IP
- 108.181.20.43
- Country
- United States
- DGA risk
- low
- DGA score
- 30.0
- Domain age days
- 4239.0
- Registrar
- Porkbun
- Created
- 2015-04-06T04:37:44Z
- Expiry
- 2028-04-05T23:59:59Z
- First seen
- 2023-09-29T13:15:07Z
- Last seen
- 2026-11-13T22:07:15Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 60%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type malware.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2015-04-06 to 2026-03-25. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type malware.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
Domain profile
summarySelected domain intelligence summary.
- Root domain
- catbox.moe
- Subdomain
- files
- Resolved IP
- 108.181.20.43
- Resolved geo
- Los Angeles, California, United States
- Country
- United States
- DGA risk
- low
- DGA score
- 30.0
- Domain age days
- 4239.0
- Registrar
- Porkbun
- Created
- 2015-04-06T04:37:44Z
- Expiry
- 2028-04-05T23:59:59Z
Infrastructure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
DNS intelligence2
0 IPs0 domains
- 1 passive DNS records
- 1 DNS records
- 0 unique IPs
- 0 related domains
View details · 1 shown
- Type
- A
TLS / certificates1
1 issuers1 subjects
- 1 certificates observed
- 1 issuers
- 1 subjects
View details · 1 shown
- Subject
- catbox.moe
- Issuer
- YE1