Report - 08b1a6c5c028…40801e637b

Malicious HighFILE

Quota 34

First seen: 2022-12-25T00:31:44Z
Last seen: 2025-02-15T11:56:02Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYbladabinditrojan

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 08b1a6c5c028df5392b3768172c3bd96cf01da479435e82dc1a55b40801e637b
SHA1: a184c464c933beef0ce8d935ac2f3462436b5de8
MD5: 630c6001d2df53f81cb01b3f8f4fcbb2
Filename: DODIK228.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 391276
Compile time: 2022-03-03T13:15:57Z
PE platform: x86 32-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 67%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections67%

VirusSign confidence100%

Relationship context16 visible

Threat classificationbladabindi

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

3shown

d968a966ef474068e41256321f77807a042f1965744633d37a203a705662ec25

0% bat 313 bytes drops

Filename 1060 File type bat MIME text/plain Size 313 SHA1 09baaa253a49d80c18326dfbca106551ebf22dd6

79dc8659dc41b718793abf3cd28513e01202513ffb2d47d052368acaa52b8032

0% csv 525 bytes drops

Filename 1052.exe.log File type csv MIME text/plain Size 525 SHA1 4280a7cdb55de401228b623e942867d536170473

e1541479e7c7e935ac288bfc69b350ac28527bab195514e2f4f2b8cbd411f742

88% high peexe 32256 bytes drops

Filename e1541479e7c7e935ac288bfc69b350ac28527bab195514e2f4f2b8cbd411f742-dropped.bin Family bladabindi Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Related IPs

Network IPs associated with this indicator.

5shown

192.168.1.105

0% communicates

First seen 2022-12-10T07:58:06Z Last seen 2026-11-12T19:44:42Z

23.195.81.48

0% US communicates

CIDR 23.195.80.0/20 Network 23.192.0.0-23.223.255.255 First seen 2023-10-01T14:24:39Z Last seen 2026-11-13T04:03:57Z

209.197.3.8

11% high US communicates

CIDR 209.197.0.0/19 Network 209.197.0.0-209.197.31.255 First seen 2023-09-30T21:27:37Z Last seen 2026-11-13T03:12:18Z

131.107.255.255

0% US communicates

CIDR 131.107.0.0/16 Network 131.107.0.0-131.107.255.255 First seen 2023-09-30T20:19:39Z Last seen 2026-11-13T02:31:46Z

192.168.0.1

0% communicates

First seen 2022-11-14T21:34:31Z Last seen 2026-11-13T04:11:32Z

Related domains

Domains associated with this indicator.

3shown

dns.msftncsi.com

0% .com communicates

Root msftncsi.com TLD com Subdomain dns First seen 2023-09-30T20:19:39Z Last seen 2026-11-13T04:07:23Z

microsoft.com

0% .com communicates

Root microsoft.com TLD com First seen 2026-01-29T18:48:34Z Last seen 2026-11-13T04:11:55Z

crl.microsoft.com

0% .com communicates

Root microsoft.com TLD com Subdomain crl First seen 2023-09-30T22:38:44Z Last seen 2026-11-13T04:11:55Z

Related URLs

URLs associated with this indicator.

5shown

tcp://192.168.1.105:1528/

0% communicates

First seen 2022-12-28T17:52:45Z Last seen 2025-12-21T07:51:08Z

http://209.197.3.8/

10% critical communicates

First seen 2014-12-31T05:40:05Z Last seen 2026-10-07T15:43:17Z

http://23.195.81.48/

0% communicates

HTTP status 400 Content length 312 Content SHA256 4857d785cef105eb51f14cff0953520d5d552a424ad6a9c7c9331da7b7a46962 First seen 2022-11-19T17:57:33Z Last seen 2026-10-27T03:31:03Z

http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl

0% communicates

TLD com HTTP status 200 Content length 767 Content SHA256 50795b027e2bc566d3b7acb89913f8efd23b70615c9db9bf5b23323ad3132a7d First seen 2011-10-22T01:16:18Z

http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl

0% communicates

TLD com HTTP status 200 Content length 519 Content SHA256 b19f80a5970542f71e1728cdeee5d4534598329ba22fabf5bbd2280ebd6ba629 First seen 2012-06-22T07:35:22Z

Analysis details

Severity: hightrojanexefile-overlaycpu-clockdebug-checkdynamic-loadingpersistenceexec-delayinput-checkbladabindinjratwinnti

Freshness: Historical · Last seen 635 days ago.

Detection rate: 67%
Threat type: trojan
Family: bladabindi
Confidence: 100%
detection: 67 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 08b1a6c5c028df5392b3768172c3bd96cf01da479435e82dc1a55b40801e637b
SHA1: a184c464c933beef0ce8d935ac2f3462436b5de8
MD5: 630c6001d2df53f81cb01b3f8f4fcbb2
Filename: DODIK228.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 391276
Compile time: 2022-03-03T13:15:57Z
PE platform: x86 32-bit
PE sections: 6
Import libraries: 3
TLSH: T1AB84BF11B7D49972C1524D796AD86320E67DE6346B9B4E8FE3948C3CD9302C0EB71BB2
SSDEEP: 6144:0TouKrWBEu3/Z2lpGDHU3ykJwpA8IfMoat1cv3Wtm/vMwCh0e6h:0ToPWBv/cpGrU3yvPuv38Sv1CO
Imphash: 12e12319f1029ec4f8fcbed7e82df162
Richhash: 5a0b7a24cfc45ac734b73051b5669bf5
First seen: 2022-12-25T00:31:44Z
Last seen: 2025-02-15T11:56:02Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 67%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family bladabindi.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2011-10-22 to 2026-01-29. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 67%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification bladabindi

Classification context: type trojan, family bladabindi.

Intelligence freshness Historical

Last seen 635 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: DODIK228.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 391276
Compile time: 2022-03-03T13:15:57Z
PE platform: x86 32-bit
Entry point: 128304
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

input-checkdebug-checkcpu-clockexec-delaypersistencedynamic-loading

View MITRE ATT&CK details · 5 shown

T1027.002 — .NET source code contains potential unpacker
Tactics: TA0005
T1106 — .NET source code references suspicious native API functions
Tactics: TA0002
T1071 — C2 URLs / IPs found in malware configuration
Tactics: TA0011
T1082 — Checks the free space of harddrives
Tactics: TA0007
T1056 — Contains functionality to log keystrokes (.Net Source)
Tactics: TA0006 · TA0009

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 80, 137, 443

5+ outbound connections observed
4 domains, 5 IPs, 5+ URLs
Common ports: 80, 137, 443, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: 209.197.3.8
URL: http://209.197.3.8/
Protocol: HTTP

IP: 209.197.3.8
Port: 80
Protocol: TCP

Domain: 192.168.1.105
URL: tcp://192.168.1.105:1528/
Protocol: HTTP

Domain: crl.microsoft.com
URL: http://crl.microsoft.com/pki/crl/products/winpca.crl
Protocol: HTTP

Domain: crl.microsoft.com
URL: http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl
Protocol: HTTP

5 shown

DNS request activity1

A1 response IPs

1 DNS requests observed
1 unique queries
1 response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: dns.msftncsi.com
Type: A
Answers: 131.107.255.255
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 2022-03-03T13:15:57Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 128304
Sections: 6
Compile time: 2022-03-03T13:15:57Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 203740
Raw size: 203776
Permissions: rx
Entropy: 6.71

Name: .rdata
Virtual address: 208896
Virtual size: 44736
Raw size: 45056
Permissions: r
Entropy: 5.26

Name: .data
Virtual address: 253952
Virtual size: 149280
Raw size: 4096
Permissions: rw
Entropy: 4.39

Name: .didat
Virtual address: 405504
Virtual size: 400
Raw size: 512
Permissions: rw
Entropy: 3.33

Name: .rsrc
Virtual address: 409600
Virtual size: 105696
Raw size: 105984
Permissions: r
Entropy: 6.56

5 shown

Imports3

3 DLL groups

3 import DLL groups
5+ imported functions summarized

View details · 3 shown

Library: KERNEL32.dll
Functions: AllocConsole, AttachConsole, CloseHandle, CompareStringW, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW …

Library: gdiplus.dll
Functions: GdipAlloc, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdipDisposeImage, GdipFree, GdiplusShutdown …

Library: OLEAUT32.dll
Functions: SysAllocString, SysFreeString, VariantClear

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_DIALOG, RT_ICON, RT_BITMAP, RT_GROUP_ICON

View details · 5 shown

Type: RT_BITMAP
Language: NEUTRAL DEFAULT

Type: RT_ICON
Language: NEUTRAL DEFAULT

Type: RT_DIALOG
Language: UKRAINIAN DEFAULT

Type: RT_STRING
Language: UKRAINIAN DEFAULT

Type: RT_GROUP_ICON
Language: NEUTRAL DEFAULT

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check