Report - 007a4d16bc2c…3b5b561f01

Malicious CriticalFILE

Quota 44

First seen: 2026-11-10T21:41:06Z
Last seen: 2026-11-11T06:15:53Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYwingotrojan

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 007a4d16bc2ce6db37fb912ce9981f5fe168ff60ecf1b8100a99633b5b561f01
SHA1: 8092f619f4c8e2c9114cd64f6d9a12bba40cca16
MD5: d2a0edce331361d3d4149096063fb92e
Filename: plalg.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 4619696
PE platform: x64 64-bit
PE sections: 8
Import libraries: 1

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections35%

VirusSign confidence100%

Relationship context16 visible

Threat classificationwingo

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

2shown

c0aa761fb7d8d1e4449a899027f1157cf1169624110050ab6b3d316ba61f908c

0% cab 80353 bytes drops

Filename CabE790.tmp File type cab MIME application/vnd.ms-cab-compressed Size 80353 SHA1 1660781555326eae5e290b875f6eebe856e5b4fb

107d584e750c4d68e44e936cbf5df5f88e0c61b4a379ec86cc54b5ea20b7a50d

0% 512 bytes contains

Filename .xdata MIME application/octet-stream Size 512 SHA1 fbf3e2f14182cc2ba5a420333139c72354031663 First seen 2023-08-11T23:27:19Z

Related IPs

Network IPs associated with this indicator.

5shown

195.15.201.249

16% medium CH communicates

CIDR 195.15.192.0/18 Network 195.15.192.0-195.15.223.255 First seen 2023-11-26T12:52:13Z Last seen 2026-11-11T08:15:49Z

150.171.110.151

0% US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2026-08-26T14:59:32Z Last seen 2026-11-11T16:32:41Z

150.171.109.154

5% low US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2026-08-21T23:28:21Z Last seen 2026-11-11T16:17:58Z

150.171.109.152

5% low US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2026-08-16T09:11:17Z Last seen 2026-11-11T16:33:00Z

23.48.8.218

US communicates

CIDR 23.48.8.0/21 Network 23.32.0.0-23.67.255.255 First seen 2025-06-05T03:50:50Z Last seen 2026-11-11T09:45:29Z

Related domains

Domains associated with this indicator.

4shown

uz.andora188.org

5% low .org communicates

Root andora188.org TLD org Subdomain uz First seen 2026-08-13T16:08:21Z Last seen 2026-11-11T06:15:56Z

telegram.me

0% .me communicates

Root telegram.me TLD me First seen 2023-09-30T06:39:14Z Last seen 2026-11-11T14:18:01Z

steamcommunity.com

5% low .com communicates

Root steamcommunity.com TLD com First seen 2023-09-29T21:59:31Z Last seen 2026-11-11T15:53:13Z

nexusrules.officeapps.live.com

0% .com communicates

Root live.com TLD com Subdomain nexusrules.officeapps First seen 2023-09-29T01:11:46Z Last seen 2026-11-11T16:43:51Z

Related URLs

URLs associated with this indicator.

5shown

http://195.15.201.249/gate

15% medium communicates

HTTP status 404 Content length 19 Content SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 First seen 2026-11-08T05:11:53Z Last seen 2026-11-11T06:15:57Z

http://steamcommunity.com/profiles/76561198610252751/gate

5% low communicates

TLD com HTTP status 200 Content length 32289 Content SHA256 3ff5c433e96d29aa575f16b02fb44268d8e765b75ada8671bf229d2c06229579 First seen 2026-11-07T11:39:50Z

http://steamcommunity.com/profiles/76561198610252751

5% low communicates

TLD com HTTP status 200 Content length 32200 Content SHA256 821d7d4b985d1cf29008faaefd86922edb6d75b370c7801bfe8d6d637a1adbe5 First seen 2026-11-09T12:54:52Z

http://telegram.me/d33ttt

0% communicates

TLD me HTTP status 200 Content length 12384 Content SHA256 f83f7dfa43279d543dadfb958901dbc3da1fc26209fd4591764680af978bef86 First seen 2026-11-09T12:54:52Z

http://telegram.me/d33ttt/gate

0% communicates

TLD me HTTP status 200 Content length 12378 Content SHA256 46a1757b11afa82e73d08e67d0db6ebd5f361b3be39ebde08ebd17a7954de213 First seen 2026-11-07T11:39:50Z

Analysis details

Severity: criticaltrojanenv-check64bitpolymorphicobfuscatedfile-overlayexeinvalid-signaturestealerdiscoveryvidarsigned

Freshness: Fresh · Last seen today.

Detection rate: 35%
Threat type: trojan
Family: wingo
Confidence: 100%
detection: 35 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 007a4d16bc2ce6db37fb912ce9981f5fe168ff60ecf1b8100a99633b5b561f01
SHA1: 8092f619f4c8e2c9114cd64f6d9a12bba40cca16
MD5: d2a0edce331361d3d4149096063fb92e
Filename: plalg.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 4619696
PE platform: x64 64-bit
PE sections: 8
Import libraries: 1
TLSH: T178266C3755448BF9C2D5DF7092A62251BEB4F988A37633DB1B2266F81D3A7C0AE31704
SSDEEP: 49152:QMHqynXP0C6NfBl2+fQM5VA7hGcFKliOJCejGHV8UtqWB9O/5GzdiBtV:zz61BBYKQRbTvhg
Imphash: 4f2f006e2ecf7172ad368f8289dc96c1
First seen: 2026-11-10T21:41:06Z
Last seen: 2026-11-11T06:15:53Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family wingo.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2023-08-11 to 2026-11-10. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 35%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification wingo

Classification context: type trojan, family wingo.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: plalg.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 4619696
PE platform: x64 64-bit
Entry point: 397728
Sections: 8

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

env-checkobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
A PE section has a virtual size significantly larger than its raw size, consistent with packed code expanding into virtual memory at runtime
AV process strings found (often used to terminate AV products)
Adds / modifies Windows certificates
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1027 — A PE section has a virtual size significantly larger than its raw size, consistent with packed code expanding into virtual memory at runtime
Tactics: TA0005
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005
T1057 — Attempted to enumerate running processes from dynamically allocated (unbacked) memory
Tactics: TA0007
T1112 · T1547 — Attempted to modify the Windows registry from dynamically allocated (unbacked) memory
Tactics: TA0003 · TA0004 · TA0112

5 shown

View MBC details · 5 shown

C0027.001 — AES
Objectives: OC0005
C0040 — Allocate Thread Local Storage
Objectives: OC0003
Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
C0026.001 — Base64
Objectives: OC0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53

5+ outbound connections observed
3 domains, 5 IPs, 5+ URLs
Common ports: 443, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: 195.15.201.249
URL: https://195.15.201.249/gate
Protocol: HTTP

IP: 195.15.201.249
Port: 443
Protocol: TCP

Domain: 195.15.201.249
URL: http://195.15.201.249/gate
Protocol: HTTP

Domain: steamcommunity.com
URL: http://steamcommunity.com/profiles/76561198610252751/gate
Protocol: HTTP

Domain: steamcommunity.com
URL: http://steamcommunity.com/profiles/76561198610252751
Protocol: HTTP

5 shown

DNS request activity4

A5+ response IPs

4 DNS requests observed
4 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 4 shown

Query: uz.andora188.org
Type: A
Answers: 104.21.14.237, 172.67.160.198
Response: NOERROR

Query: steamcommunity.com
Type: A
Answers: 23.48.8.218
Response: NOERROR

Query: telegram.me
Type: A
Answers: 149.154.167.99
Response: NOERROR

Query: nexusrules.officeapps.live.com
Type: A
Answers: 150.171.109.154, 150.171.109.152, 150.171.109.72, 150.171.110.151, 150.171.110.211, 150.171.109.117, 150.171.110.4
Response: NOERROR

C2 candidates2

HTTP, TCPports 443

2 C2 candidate communications
1 domains, 1 IPs
Common ports: 443
Protocols: HTTP, TCP

View details · 2 shown

Domain: 195.15.201.249
Protocol: HTTP

IP: 195.15.201.249
Port: 443
Protocol: TCP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present

View details · 1 shown

Platform: x64 64-bit
Entry point: 397728
Sections: 8

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 2126539
Raw size: 2126848
Permissions: rx
Entropy: 6.18

Name: .rdata
Virtual address: 2134016
Virtual size: 2258120
Raw size: 2258432
Permissions: r
Entropy: 6.65

Name: .data
Virtual address: 4395008
Virtual size: 434160
Raw size: 68608
Permissions: rw
Entropy: 4.22

Name: .pdata
Virtual address: 4829184
Virtual size: 22200
Raw size: 22528
Permissions: r
Entropy: 5.25

Name: .xdata
Virtual address: 4853760
Virtual size: 156
Raw size: 512
Permissions: r
Entropy: 1.54

5 shown

Imports1

1 DLL groups

1 import DLL groups
5+ imported functions summarized

View details · 1 shown

Library: kernel32.dll
Functions: AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateFileA, CreateIoCompletionPort, CreateThread, CreateWaitableTimerExW, DuplicateHandle …

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates4

4 issuers

Example subject: Blue Union Collective
Issued by: Blue Union Collective

View details · 4 shown

Subject: Blue Union Collective
Issuer: Blue Union Collective
Fingerprint: DFB7F5DDE2306B66365B208FF1F4B9D373F22A9A

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

Subject: DigiCert SHA256 RSA4096 Timestamp Responder 2026 1
Issuer: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Fingerprint: 51D9ABDA034973D84F4266ACA48248E6B369C439

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check