Report - 0baf546d6ac9…41a396dbe7

Suspicious HighFILE

Quota 30

First seen: 2010-10-05T10:40:32Z
Last seen: 2026-10-08T23:52:59Z

THREAT SIGNALLow Read alongside the verdict

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedmalware

RELATED INDICATORS21Connections in this report

ANALYSISSuspiciousAging

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: 0baf546d6ac9fd853b11cba89d3f314ca3ff0ca791224aa0753f0441a396dbe7
SHA1: e0e596de4ddb7f5f3ab366bc8716e8af30aa66c7
MD5: ce2ae795117e54ca8403f86e7a3e19a7
Filename: 0baf546d_dnsbench.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 167296
Compile time: 2010-09-30T23:58:38Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Threat context

Classification includes type malware.

Analysis signals

OBSERVED

Engine detections4%

Relationship context21 visible

Threat classificationmalware

Intelligence freshnessAging

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

21 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

b13bffcba06676749b63c642dee1987e7a5d578f0f8a190e12ec561e42b7ff1b

38% high peexe 3700736 bytes drops

Filename b13bffcb_lll.exe.bin Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 3700736

26f3f2fb9e530a77b5ee5d400207f06e11519a967df27166e0ef1d5975b93054

74% high peexe 1887744 bytes drops

Filename 26f3f2fb_file_to_send.bin Family bulz Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

6549d7e83fb30f02fe821bc49ba4da7d4914d7c8a2f2ebe0ca84bde2f8906e8c

96% high peexe 379059 bytes drops

Filename 6549d7e8_3.exe.bin Family swisyn Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

5ec469cb373755c230dc06460666cce211b9c703761a1778f098bfaadc10f651

68% critical peexe 441061 bytes drops

Filename 5ec469cb_dns2.exe_.bin Family plugx Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

3ca6deaac0a5790474a9289755e82e7b43460b360e5500d7c9715c7be156b568

74% critical peexe 1953792 bytes drops

Filename 3ca6deaa_47a0194cf29da3d867f64da95390b57b.virus.bin Family zbot Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Dropped / child files

Files dropped, bundled, or created by the queried file.

2shown

ee0f1a2c4046c810340c448804a89c5fca6ef0a6768966678347a5732b83fadc

0% mz 154112 bytes contains

Filename ee0f1a2c_dnsbench.bin File type mz MIME application/octet-stream Size 154112 SHA1 9ababd7d10c32de2650c6c30ecd0636d94a9363e

8b51b2384957d143bbbfc1c15ce3acdbb65990d4b474e4e8359e092c8c19a82c

0% xml 664 bytes contains

Filename 8b51b238_1.bin File type xml MIME application/xml Size 664 SHA1 6148be6e7d9cc1d1770cb6fa0791f7bc4a9d0d6d

Related IPs

Network IPs associated with this indicator.

5shown

23.198.171.50

5% low US communicates

CIDR 23.198.160.0/19 Network 23.192.0.0-23.223.255.255 First seen 2024-04-27T05:07:46Z Last seen 2026-11-15T06:15:47Z

4.2.2.1

0% US communicates

CIDR 4.0.0.0/12 Network 4.0.0.0-4.127.255.255 First seen 2023-10-01T06:07:17Z Last seen 2026-11-14T05:06:10Z

208.67.220.220

5% low US communicates

CIDR 208.67.216.0/21 Network 208.67.216.0-208.67.223.255 First seen 2023-09-29T21:15:33Z Last seen 2026-11-15T07:50:59Z

208.67.222.222

0% US communicates

CIDR 208.67.216.0/21 Network 208.67.216.0-208.67.223.255 First seen 2023-09-29T21:15:33Z Last seen 2026-11-15T07:50:59Z

127.0.0.1

5% medium communicates

First seen 2021-03-06T21:30:58Z Last seen 2026-11-15T08:12:38Z

Related domains

Domains associated with this indicator.

5shown

1.2.2.4.test.senderbase.org

.org communicates

Root senderbase.org TLD org Subdomain 1.2.2.4.test First seen 2026-08-15T07:56:26Z Last seen 2026-09-03T01:39:30Z

1.2.2.4.origin.asn.cymru.com

.com communicates

Root cymru.com TLD com Subdomain 1.2.2.4.origin.asn First seen 2026-01-21T10:36:03Z Last seen 2026-09-03T01:39:30Z

1.194.153.198.test.senderbase.org

.org communicates

Root senderbase.org TLD org Subdomain 1.194.153.198.test First seen 2026-08-15T07:56:26Z Last seen 2026-09-03T01:39:30Z

1.194.153.198.origin.asn.cymru.com

.com communicates

Root cymru.com TLD com Subdomain 1.194.153.198.origin.asn First seen 2026-01-21T10:36:03Z Last seen 2026-09-03T01:39:30Z

1.192.153.198.test.senderbase.org

.org communicates

Root senderbase.org TLD org Subdomain 1.192.153.198.test First seen 2026-08-15T07:56:26Z Last seen 2026-09-03T01:39:30Z

Related URLs

URLs associated with this indicator.

4shown

http://isc.org/

0% communicates

TLD org HTTP status 200 Content length 23481 Content SHA256 c89dad2bedc0c6d8498940e1d68ae4c50109670ab9bba357180dfb706da0ec16 First seen 2012-03-27T10:29:26Z

https://www.grc.com/x/ne.dll?…

0% communicates

TLD com HTTP status 200 Content length 3157 Content SHA256 c76db68d81ba9e0a291d81dd2a47dffa02dda2ff64833e155413683b40dfbebf First seen 2014-05-26T02:20:28Z

http://www.grc.com/x/ne.dll?…

0% communicates

TLD com HTTP status 200 Content length 17160 Content SHA256 786e9ee0b2f612a8766333c73e21b1e3bbe65f2916d4cdceda80a6b8a74942b5 First seen 2012-07-09T13:50:13Z

http://www.digicert.com/CACerts/DigiCertHighAssuranceEVRootCA.crt

0% communicates

TLD com HTTP status 200 Content length 969 Content SHA256 7431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf First seen 2012-02-23T16:28:31Z

Analysis details

Severity: highmalwaredebug-checkinvalid-signatureexec-delayadapter-discoverydns-anomalysuspicious-udpinput-checkfile-overlaylegitdns-nxdomainupxsigned

Freshness: Aging · Last seen 37 days ago.

Detection rate: 4%
Threat type: malware
detection: 4 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 0baf546d6ac9fd853b11cba89d3f314ca3ff0ca791224aa0753f0441a396dbe7
SHA1: e0e596de4ddb7f5f3ab366bc8716e8af30aa66c7
MD5: ce2ae795117e54ca8403f86e7a3e19a7
Filename: 0baf546d_dnsbench.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 167296
Compile time: 2010-09-30T23:58:38Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 11
TLSH: T110F312951B953A16F369373460FF851AA0767ACA8DCA7EC3616886D72FA82D1370430F
SSDEEP: 3072:8C7CCUTCdjErqpymhisuydhMbP2zXBdBJDijZxa8pi:NXUT+EWfis9d2qzxx+Vx1c
Imphash: a47325e6eaa46d0dcab30193049c1232
Richhash: ee902081135091bf2a25d4f3bb6e9f41
First seen: 2010-10-05T10:40:32Z
Last seen: 2026-10-08T23:52:59Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Threat context

Classification includes type malware.

Relationship context

21 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

22 timestamped observations are arranged from 2010-09-30 to 2026-08-15. These are observation or metadata times, not execution order.

Infrastructure geography

4 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 4%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

Relationship context 21 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification malware

Classification context: type malware.

Intelligence freshness Aging

Last seen 37 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 0baf546d_dnsbench.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 167296
Compile time: 2010-09-30T23:58:38Z
PE platform: x86 32-bit
Entry point: 685824
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

adapter-discoveryinput-checkdebug-checkcpu-clockexec-delaydynamic-loading

View details · 5 shown

A file with an unusual extension was attempted to be loaded as a DLL.
A process attempted to delay the analysis task.
Attempts to connect to a dead IP:Port (3 unique times)
Binary may include packed or encrypted code
Checks adapter addresses which can be used to detect virtual network interfaces

5 shown

View MITRE ATT&CK details · 5 shown

T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Tactics: TA0011
T1573 — Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Tactics: TA0011
T1539 — An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Tactics: TA0006
T1027.002 — Binary may include packed or crypted data
Tactics: TA0005
T1056 — Creates a DirectInput object (often for capturing keystrokes)
Tactics: TA0006 · TA0009

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Communication
Objectives: OC0006
C0002 — HTTP Communication
Objectives: OC0006
C0005.001 — InternetConnect
Objectives: OC0006
B0007 — Sandbox Detection
Objectives: OB0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

UDP, TCP, HTTPports 53, 137, 443

5+ outbound connections observed
3 domains, 5+ IPs, 5 URLs
Common ports: 53, 137, 443, 80, 5355
Protocols: UDP, TCP, HTTP

View details · 5 shown

IP: 8.8.8.8
Port: 53
Protocol: UDP

IP: 8.8.4.4
Port: 53
Protocol: UDP

IP: 23.198.171.50
Port: 443
Protocol: TCP

IP: 208.67.220.220
Port: 53
Protocol: UDP

IP: 13.107.4.50
Port: 80
Protocol: TCP

5 shown

DNS request activity5+

A, A/AAAA, AAAA5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A, A/AAAA, AAAA
Response codes: NOERROR

View details · 5 shown

Query: 222.222.67.208.in-addr.arpa

Query: zy4j4pvx2w4ushkzigqsemdlvg.com

Query: zvyjehfw01na0eshc5t2wy52ge.com

Query: zpv3qdntxcu54ytnaerwybwufa.com

Query: zpcgzwexykh5lnrvsaq2ax0r4f.com

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2010-09-30T23:58:38Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 685824
Sections: 3
Compile time: 2010-09-30T23:58:38Z

PE sections3

3 sections

3 PE sections
Common permissions: rwx, rw
1 unique section names

View details · 3 shown

Virtual address: 4096
Virtual size: 528384
Raw size: 0
Permissions: rwx
Entropy: 0.0

Virtual address: 532480
Virtual size: 155648
Raw size: 154112
Permissions: rwx
Entropy: 7.91

Name: .
Virtual address: 688128
Virtual size: 8192
Raw size: 6656
Permissions: rw
Entropy: 3.93

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.DLL
Functions: ExitProcess, GetProcAddress, LoadLibraryA

Library: ADVAPI32.dll
Functions: RegCloseKey

Library: COMCTL32.dll
Functions: Ord(6)

Library: comdlg32.dll
Functions: GetSaveFileNameA

Library: GDI32.dll
Functions: PatBlt

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_RCDATA, RT_ICON, RT_ACCELERATOR, RT_CURSOR, RT_GROUP_CURSOR

View details · 5 shown

Type: RT_CURSOR
Language: ENGLISH US

Type: RT_ICON
Language: ENGLISH US

Type: RT_ACCELERATOR
Language: ENGLISH US

Type: RT_RCDATA
Language: ENGLISH US

Type: RT_GROUP_CURSOR
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

4 issuers

Example subject: Gibson Research Corporation
Issued by: VeriSign Class 3 Code Signing 2009-2 CA
Validity period (UTC): 2009-06-18 – 2012-09-07

View details · 5 shown

Subject: Gibson Research Corporation
Issuer: VeriSign Class 3 Code Signing 2009-2 CA
Valid from: 1245283200.0
Valid to: 1347062340.0
Fingerprint: 6EAEFF3F98EAE9EEF9022876B3E85DD495194623

Subject: VeriSign Class 3 Code Signing 2009-2 CA
Issuer: Class 3 Public Primary Certification Authority
Valid from: 1242864000.0
Valid to: 1558396740.0
Fingerprint: 12D4872BC3EF019E7E0B6F132480AE29DB5B1CA3

Subject: VeriSign Class 3 Public Primary CA
Issuer: Class 3 Public Primary Certification Authority
Valid from: 822873600.0
Valid to: 1848787140.0
Fingerprint: 742C3192E607E424EB4549542BE1BBC53E6174E2

Subject: VeriSign Time Stamping Services Signer - G2
Issuer: VeriSign Time Stamping Services CA
Fingerprint: ADA8AAA643FF7DC38DD40FA4C97AD559FF4846DE

Subject: VeriSign Time Stamping Services CA
Issuer: Thawte Timestamping CA
Fingerprint: F46AC0C6EFBB8C6A14F55F09E2D37DF4C0DE012D

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check