Report - 0b68a10af4db…53a1d6950e

Malicious HighFILE

Quota 28

First seen: 2013-05-29T12:37:35Z
Last seen: 2025-11-14T23:04:22Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYr002c0ojr23trojan

RELATED INDICATORS18Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 0b68a10af4db5adae960f5f7e51dcebc8a87fbb0ea98d33f9af2fc53a1d6950e
SHA1: 0515290c8059f3532b061b79dea8e683d6fb1cf9
MD5: 204db56d8e36d49883ac4cd0e73c0313
Filename: VCDS-Beta-12.10.3-Installer%28R%29.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 12673133
Compile time: 2009-12-05T22:50:46Z
PE platform: x86 32-bit
PE sections: 5

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections35%

VirusSign confidence100%

Relationship context18 visible

Threat classificationr002c0ojr23

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

18 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

3shown

8cb6ea9166eb6ac93578c2157ac406fff25607fbdf896bfb1ebb36ea8af6aca8

39% critical rar 31932644 bytes contains

Filename шнур с надписью 12.1.rar Family installcore Type trojan File type rar MIME application/vnd.rar

25d24ce448ee3940153c24b3462262014486eeeed44898b47f9ec37d14544207

18% high rar 165010733 bytes contains

Filename vag com 12.12.rar Family ramnit Type trojan File type rar MIME application/vnd.rar

b51da4eb7b719948e69755d627367fb9bbc69f0cbe0fcd7609cd4c87ab95ee8a

42% critical rar 13217792 bytes contains

Family installcore Type trojan File type rar MIME application/vnd.rar Size 13217792

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

d129201d12134d22fcb7a9285fe273fe5d4c5d86783c9cb03777cdb1b78341b1

0% bmp 25818 bytes drops

Filename 68778c4eeee6ed494d098ca5d19f7572 File type bmp MIME application/octet-stream Size 25818 SHA1 eb715254de3a007362b9e3488e33ca39c772692d

c2588668d431dea748de1b4229bda6115f47eabe62d6c2ee622b414395784589

0% peexe 324416 bytes drops

Filename VCScope.exe (copy) File type peexe MIME application/vnd.microsoft.portable-executable Size 324416 Compile time 2011-10-25T17:44:12Z

ebe0623331323d7a8906b6292de450ecf8e0f9852d3ee0657b0256f5aed5a76b

0% javascript 3109 bytes drops

Filename 028-90~1.LBL File type javascript MIME application/javascript Size 3109 SHA1 e66478e9506ee50fa38a418e3a12aa59956c5950

da0bc50f59b18af5b134bae4f1a90724357f8b585cda80b77208a3f7a0c054bf

0% javascript 1881 bytes drops

Filename 3b0-959-800.lbl File type javascript MIME application/javascript Size 1881 SHA1 6643d335b96b988acd6e3a3fc349c15fadd0fa64

d0e40520151b31fa30a18a0959963c97f26e1eed45ad6d593c95b0b5a8fc976a

0% javascript 1302 bytes drops

Filename 02D-900-554.lbl (copy) File type javascript MIME application/javascript Size 1302 SHA1 d58cecf95a538a13e392fee3c9e211aeb0b4d648

Related IPs

Network IPs associated with this indicator.

5shown

92.123.124.167

0% communicates

CIDR 92.123.120.0/21 Country The Netherlands First seen 2026-07-16T20:43:10Z Last seen 2026-11-12T12:05:46Z

2.21.41.101

0% PL communicates

CIDR 2.21.40.0/22 First seen 2025-01-16T21:15:01Z Last seen 2026-11-12T08:12:03Z

52.202.204.11

0% US communicates

CIDR 52.200.0.0/13 Network 52.192.0.0-52.223.191.255 First seen 2023-09-30T21:13:24Z Last seen 2026-11-12T22:16:31Z

34.193.227.236

0% US communicates

CIDR 34.192.0.0/12 Network 34.192.0.0-34.255.255.255 First seen 2023-10-02T10:32:09Z Last seen 2026-11-13T00:18:50Z

18.207.85.246

0% US communicates

CIDR 18.204.0.0/14 Network 18.32.0.0-18.255.255.255 First seen 2023-10-01T00:33:28Z Last seen 2026-11-12T22:11:38Z

Related domains

Domains associated with this indicator.

5shown

www.netech.dk

0% .dk communicates

Root netech.dk TLD dk Subdomain www First seen 2026-02-03T13:09:17Z Last seen 2026-02-03T13:17:19Z

crs.cr.adobe.com

0% .com communicates

Root adobe.com TLD com Subdomain crs.cr First seen 2023-09-29T12:29:00Z Last seen 2026-11-12T10:31:38Z

cc-api-data.adobe.io

0% .io communicates

Root adobe.io TLD io Subdomain cc-api-data First seen 2023-09-28T23:48:47Z Last seen 2026-11-12T23:29:15Z

p13n.adobe.io

0% .io communicates

Root adobe.io TLD io Subdomain p13n First seen 2023-09-28T19:16:46Z Last seen 2026-11-12T14:15:18Z

geo2.adobe.com

0% .com communicates

Root adobe.com TLD com Subdomain geo2 First seen 2023-09-28T19:16:46Z Last seen 2026-11-12T21:43:34Z

Analysis details

Severity: hightrojandynamic-loadingfile-overlaydebug-checkexensiscpu-clock

Freshness: Historical · Last seen 363 days ago.

Detection rate: 35%
Threat type: trojan
Family: r002c0ojr23
Confidence: 100%
detection: 35 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 0b68a10af4db5adae960f5f7e51dcebc8a87fbb0ea98d33f9af2fc53a1d6950e
SHA1: 0515290c8059f3532b061b79dea8e683d6fb1cf9
MD5: 204db56d8e36d49883ac4cd0e73c0313
Filename: VCDS-Beta-12.10.3-Installer%28R%29.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 12673133
Compile time: 2009-12-05T22:50:46Z
PE platform: x86 32-bit
PE sections: 5
Import libraries: 8
TLSH: T186D63300D7A07419F99838BA6C7C9AF1ADF36F4811527D0EC5FAB7271275633C884AAC
SSDEEP: 393216:PzsoB7LI1K9+EVaGjx7HUsO0bM4Lt4eViD:PXeGN709k5tViD
Imphash: 099c0646ea7282d232219f8807883be0
Richhash: 81c790eab65ff0be64a9029444dd0f7f
First seen: 2013-05-29T12:37:35Z
Last seen: 2025-11-14T23:04:22Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family r002c0ojr23.

Relationship context

18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

19 timestamped observations are arranged from 2009-04-16 to 2026-07-16. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 35%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 18 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification r002c0ojr23

Classification context: type trojan, family r002c0ojr23.

Intelligence freshness Historical

Last seen 363 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: VCDS-Beta-12.10.3-Installer%28R%29.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 12673133
Compile time: 2009-12-05T22:50:46Z
PE platform: x86 32-bit
Entry point: 12860
Sections: 5

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkcpu-clockdynamic-loading

View details · 5 shown

Binary contains paths to debug symbols
Checks the free space of harddrives
Classification label
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory

5 shown

View MITRE ATT&CK details · 5 shown

T1555.003 — Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Tactics: TA0006
T1003 — Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.
Tactics: TA0006
T1564 — Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
Tactics: TA0005
T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Tactics: TA0011
T1485 — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Tactics: TA0040

5 shown

View MBC details · 5 shown

C0032.001 — CRC32
Objectives: OC0004
E1510 — Clipboard Modification
Objectives: OB0008
E1059 — Command and Scripting Interpreter
Objectives: OB0009
Communication
Objectives: OC0006
C0045 — Copy File
Objectives: OC0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDPports 443, 123, 53

5+ outbound connections observed
0 domains, 5+ IPs, 0 URLs
Common ports: 443, 123, 53, 80
Protocols: TCP, UDP

View details · 5 shown

IP: a83f:8110:0:0:100:0:1800:0
Port: 53
Protocol: UDP

IP: 92.123.124.167
Port: 443
Protocol: TCP

IP: 64.4.10.33
Port: 123
Protocol: UDP

IP: 52.202.204.11
Port: 443
Protocol: TCP

IP: 23.46.201.17
Port: 443
Protocol: TCP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: p13n.adobe.io
Type: A
Answers: 34.193.227.236, 107.22.247.231, 54.144.73.197, 18.207.85.246
Response: NOERROR

Query: geo2.adobe.com
Type: A
Answers: 23.36.68.10
Response: NOERROR

Query: geo2.adobe.com
Type: A
Answers: 92.123.124.167
Response: NOERROR

Query: crs.cr.adobe.com
Type: A
Answers: 192.147.130.166
Response: NOERROR

Query: cc-api-data.adobe.io
Type: A
Answers: 52.5.13.197, 54.227.187.23, 23.22.254.206, 52.202.204.11
Response: NOERROR

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5 sections

Platform: x86 32-bit
Sections: 5
Entry point: present
Compile time: 2009-12-05T22:50:46Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 12860
Sections: 5
Compile time: 2009-12-05T22:50:46Z

PE sections5

5 sections

5 PE sections
Common permissions: r, rw, rx
5 unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 23130
Raw size: 23552
Permissions: rx
Entropy: 6.43

Name: .rdata
Virtual address: 28672
Virtual size: 4496
Raw size: 4608
Permissions: r
Entropy: 5.18

Name: .data
Virtual address: 36864
Virtual size: 110488
Raw size: 1024
Permissions: rw
Entropy: 4.71

Name: .ndata
Virtual address: 147456
Virtual size: 90112
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .rsrc
Virtual address: 237568
Virtual size: 38016
Raw size: 38400
Permissions: r
Entropy: 5.86

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: CloseHandle, CompareFileTime, CopyFileA, CreateDirectoryA, CreateFileA, CreateProcessA, CreateThread, DeleteFileA …

Library: USER32.dll
Functions: AppendMenuA, BeginPaint, CallWindowProcA, CharNextA, CharPrevA, CheckDlgButton, CloseClipboard, CreateDialogParamA …

Library: GDI32.dll
Functions: CreateBrushIndirect, CreateFontIndirectA, DeleteObject, GetDeviceCaps, SelectObject, SetBkColor, SetBkMode, SetTextColor

Library: SHELL32.dll
Functions: SHBrowseForFolderA, ShellExecuteA, SHFileOperationA, SHGetFileInfoA, SHGetPathFromIDListA, SHGetSpecialFolderLocation

Library: ADVAPI32.dll
Functions: RegCloseKey, RegCreateKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegQueryValueExA …

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_DIALOG, RT_ICON, RT_BITMAP, RT_GROUP_ICON, RT_MANIFEST

View details · 5 shown

Type: RT_BITMAP
Language: ENGLISH US

Type: RT_ICON
Language: ENGLISH US

Type: RT_DIALOG
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

Type: RT_VERSION
Language: ENGLISH US

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check