Report - 0ec9f22f5829…9f974dcd21

Malicious HighFILE

Quota 22

First seen: 2026-10-19T02:51:34Z
Last seen: 2026-10-21T07:03:52Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYdllhijacktrojan

RELATED INDICATORS7Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 0ec9f22f582910ccd6147e238a209b8a10184ffba27c544049467a9f974dcd21
SHA1: 50af0fa6c2f615e54c8bd820d81e3fd9f91a25d2
MD5: b21ebe05a7cd1683f6c5e9b67cccb9d2
Filename: appshare.dll
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 902536
Compile time: 2026-10-16T08:44:00Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections46%

VirusSign confidence100%

Relationship context7 visible

Threat classificationdllhijack

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

7 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

2shown

eee158d88f273535551ac18c22a1cfe73fe34ea8eef86240adbc206199f98e24

14% high zip 2091534 bytes contains

Filename test.zip Family lotok Type trojan File type zip MIME application/zip

eceeadd696efdf846c12af1c36839abd207c3557b7555757e745c24094a315b8

50% high isoimage 5089280 bytes contains

Filename DX04_11709.img Family dllhijack Type trojan File type isoimage MIME application/octet-stream

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

e42efd0f77978a88dc57dce5859f40dea2908d73bbe7ca7dcce036ead7020070

61% high peexe 66912 bytes drops

Filename erasecode.dat Family yogi Type adware File type peexe MIME application/vnd.microsoft.portable-executable

8aaa290109531a4af4334ec056a8e144fd251761a4684a2a35e61732748d8fa9

0% ico 9662 bytes contains

Filename VirusShare_4e986d9d7425b0c3799af8124a299b3e File type ico MIME application/octet-stream Size 9662 SHA1 0716722a88ca46961915a5cea4c06ce96ee0ed2d

9a6a6c6c6c850a64bf015d15b2ab5436aacf512bc5ae7d647b3a228ffc84c199

0% ico 4286 bytes contains

Filename VirusShare_a775e13908f9cf35b19aa988a506e47e File type ico MIME application/octet-stream Size 4286 SHA1 785f325c7f21f554c85a32a3f6e6bcbee2da97c7

078ea7e98303d3765240c0fefbf9d5d143888eb8082cdb31c8dbfcd9779f02cc

0% ico 67646 bytes contains

Filename VirusShare_5cb311859df6b212afd49f52322ef257 File type ico MIME application/octet-stream Size 67646 SHA1 6e0e0c7cbb488c4549d88c4a906ff4fb7cda5d73

101c30de620e4bed1b4befed96a4d3819e8b40b06a8e4cff699ea89e9813b9ed

0% ico 38078 bytes contains

Filename VirusShare_b2d5de18a0df52c852942199e50ebb83 File type ico MIME application/octet-stream Size 38078 SHA1 f1f4da85b5a6fe04325bedc444c117a7b1f0924e

Analysis details

Severity: hightrojaninput-checkdll64bitfile-overlaydebug-checkinvalid-signatureobfuscatedsigned

Freshness: Recent · Last seen 21 days ago.

Detection rate: 46%
Threat type: trojan
Family: dllhijack
Confidence: 100%
detection: 46 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 0ec9f22f582910ccd6147e238a209b8a10184ffba27c544049467a9f974dcd21
SHA1: 50af0fa6c2f615e54c8bd820d81e3fd9f91a25d2
MD5: b21ebe05a7cd1683f6c5e9b67cccb9d2
Filename: appshare.dll
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 902536
Compile time: 2026-10-16T08:44:00Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 6
TLSH: T1DD157CFFAA580BA9E0577130BC571481E7A27F370271E18E03E337651F277674A6A226
SSDEEP: 12288:V8QT5cO8E/Bw7idT5acSmzbzryzh9O8nRf3LnuhNOb5P7+g:qGiWdThnzbzryZ7nuXrg
Imphash: c09d5870c6b60da78c05489d931e295e
Richhash: ab21a7686a24873763b4beece6bafe1c
First seen: 2026-10-19T02:51:34Z
Last seen: 2026-10-21T07:03:52Z
Filename variants: 3 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family dllhijack.

Relationship context

7 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

8 timestamped observations are arranged from 2016-05-18 to 2026-10-18. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 46%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 7 visible

2 relationship group(s) provide pivot and infrastructure context.

Threat classification dllhijack

Classification context: type trojan, family dllhijack.

Intelligence freshness Recent

Last seen 21 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: appshare.dll
File type: pedll
MIME: application/vnd.microsoft.portable-executable
Size: 902536
Compile time: 2026-10-16T08:44:00Z
PE platform: x64 64-bit
Entry point: 210756
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

input-checkdebug-checkobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
AV process strings found (often used to terminate AV products)
Authenticode signature is invalid
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
Binary contains paths to debug symbols

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1071 — Binary file triggered YARA rule
Tactics: TA0011
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007
T1547.008 — Enables driver privileges
Tactics: TA0003 · TA0004

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
C0026.001 — Base64
Objectives: OC0004
C0019 — Check String
Objectives: OC0004
E1059 — Command and Scripting Interpreter
Objectives: OB0009

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-10-16T08:44:00Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 210756
Sections: 7
Compile time: 2026-10-16T08:44:00Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 393344
Raw size: 393728
Permissions: rx
Entropy: 6.47

Name: .rdata
Virtual address: 401408
Virtual size: 125110
Raw size: 125440
Permissions: r
Entropy: 5.06

Name: .data
Virtual address: 528384
Virtual size: 17932
Raw size: 10240
Permissions: rw
Entropy: 3.69

Name: .pdata
Virtual address: 548864
Virtual size: 16908
Raw size: 17408
Permissions: r
Entropy: 5.61

Name: .fptable
Virtual address: 569344
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: AssignProcessToJobObject, CloseHandle, CompareStringEx, CompareStringW, CreateDirectoryW, CreateFileW, CreateJobObjectW, CreatePipe …

Library: USER32.dll
Functions: FindWindowW, SendMessageW, SetWindowPos, ShowWindow

Library: ADVAPI32.dll
Functions: AdjustTokenPrivileges, AllocateAndInitializeSid, CheckTokenMembership, CloseServiceHandle, CreateServiceW, FreeSid, GetTokenInformation, LookupPrivilegeValueW …

Library: SHELL32.dll
Functions: CommandLineToArgvW, SHGetFolderPathW

Library: ole32.dll
Functions: CoCreateInstance, CoGetObject, CoInitializeEx, CoUninitialize

5 shown

Exports5+

5+ exported items

5+ exported items

View details · 5 shown

Name: ??0IWmeUnknown@wme@@QEAA@AEBV01@@Z

Name: ??0IWmeUnknown@wme@@QEAA@XZ

Name: ??1IWmeUnknown@wme@@UEAA@XZ

Name: ??4IWmeUnknown@wme@@QEAAAEAV01@AEBV01@@Z

Name: ??_7IWmeUnknown@wme@@6B@

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, RESDATA, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION

View details · 5 shown

Type: RESDATA
Language: CHINESE TRADITIONAL

Type: RT_ICON
Language: CHINESE TRADITIONAL

Type: RT_GROUP_ICON
Language: CHINESE TRADITIONAL

Type: RT_VERSION
Language: CHINESE TRADITIONAL

Type: RT_MANIFEST
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates4

4 issuers

Example subject: Wondershare Technology Group Co.,Ltd
Issued by: Wondershare Technology Group Co.,Ltd
Validity period (UTC): 2002-12-31 – 2099-12-30

View details · 4 shown

Subject: Wondershare Technology Group Co.,Ltd
Issuer: Wondershare Technology Group Co.,Ltd
Valid from: 1041350400.0
Valid to: 4102329600.0
Fingerprint: 96C0F81A2F44C8E308017D5C788FA1378A0F6047

Subject: Sectigo Public Time Stamping Root R46
Issuer: USERTrust RSA Certification Authority
Fingerprint: 853D632D938282617CD09035C491DE92C142DAC7

Subject: Sectigo Public Time Stamping CA R41
Issuer: Sectigo Public Time Stamping Root R46
Fingerprint: 65C328696F7D4E502CFD03C7C2069718CAFBF74F

Subject: Sectigo Public Time Stamping Signer R37
Issuer: Sectigo Public Time Stamping CA R41
Fingerprint: E97818A928DA150A9FE1BF9CCC7AABB9A00EEEAC

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check