Report - 115afc8a4263…ba16805328

Malicious HighFILE

Quota 34

First seen: 2026-10-13T16:44:15Z
Last seen: 2026-10-29T16:33:12Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmsiltrojan

RELATED INDICATORS13Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 115afc8a426319ad5ffedb82cc4a338c08abd72ee7c5f7ef33c806ba16805328
SHA1: d940b20abd5d2fc651dc67cfbaffa4c41163c042
MD5: 62cf067f8dd3f7a8dee0073405e7846a
Filename: 69D5BRzlC3074655.eml
File type: email
MIME: message/rfc822
File size: 1965536
TLSH: T10795232D9E6D1BDE4D00E2FEBA13A84832CC22CB44D6576B02BD93B5B9F5434D257C62
SSDEEP: 24576:2piQeuq358toMl2WftaI/JHAkcrf/b9eKae3lQKIG//NCCL+oxvcUO8WPAbglGnO:SKgd9/JHaLcUDeEg/T

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 52%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections52%

VirusSign confidence100%

Relationship context13 visible

Threat classificationmsil

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

13 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

637c76c03979f6c1637dc53be98d34f24734eef46c2ba2ed03211689b23904e7

0% doc 2560 bytes drops

Filename Outlook.srs File type doc MIME application/octet-stream Size 2560 SHA1 66c406276fb78aecdbdc2d0587e44b1c17511c4b

50756b98463a729f0aec52d9fe1c059f069369072e016419e739fc2aeda0f055

10% high lnk 786 bytes drops

Filename XWormClient.lnk Family lnkrun Type trojan File type lnk MIME application/x-ms-shortcut

500bd4f497d996e2b889a6823f46fe4f281a7884194c5fe6c9b26dca5a4197c6

0% xml 192526 bytes drops

Filename 54807452-FC2E-4457-9302-3D864A535D62 File type xml MIME application/xml Size 192526 SHA1 bb3293eb4468fe15936400521222f71245af1e00

159e5ecfdf369352e30576d72ca3788f5e6a67f031a1a53a1ce5378bf70c0a33

69% high peexe 566784 bytes drops

Filename 3b570ps.exe Family msil Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

33b9d48bb5118e42da6641a10594e4cf57d6a34d0a5d294024bc1ae477d7f2c2

72% critical rar 1428607 bytes drops

Filename 58e7dbe2ecc07f1488213b595868a653.file Family msil Type trojan File type rar MIME application/vnd.rar

Related IPs

Network IPs associated with this indicator.

5shown

172.94.15.100

29% high DE communicates

CIDR 172.94.14.0/23 Network 172.94.15.0-172.94.15.255 First seen 2025-11-28T17:07:40Z Last seen 2026-11-10T09:48:03Z

52.110.2.76

0% US communicates

CIDR 52.96.0.0/12 Network 52.96.0.0-52.115.255.255 First seen 2023-10-08T07:06:01Z Last seen 2026-11-10T07:15:59Z

52.110.2.67

0% US communicates

CIDR 52.96.0.0/12 Network 52.96.0.0-52.115.255.255 First seen 2023-09-29T04:20:51Z Last seen 2026-11-10T00:05:55Z

52.110.2.40

0% US communicates

CIDR 52.96.0.0/12 Network 52.96.0.0-52.115.255.255 First seen 2023-10-01T03:58:19Z Last seen 2026-11-10T09:32:21Z

52.110.2.12

0% US communicates

CIDR 52.96.0.0/12 Network 52.96.0.0-52.115.255.255 First seen 2023-10-04T10:12:13Z Last seen 2026-11-10T06:57:21Z

Related domains

Domains associated with this indicator.

2shown

svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain svc First seen 2023-11-09T10:19:11Z Last seen 2026-11-10T14:49:23Z

roaming.svc.cloud.microsoft

5% low .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain roaming.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-10T14:49:23Z

Related URLs

URLs associated with this indicator.

1shown

https://roaming.svc.cloud.microsoft/rs/RoamingSoapService.svc

0% communicates

TLD microsoft HTTP status 400 Content SHA256 855bb50e73e6b2d1c6d6d69ee436c9dfcc5b390a49d50119f8f2eea677bcaefd First seen 2025-08-22T00:53:09Z Last seen 2026-11-10T14:49:24Z

Analysis details

Severity: hightrojanpolymorphicemailwmi-activityobfuscatedpersistenceself-delete

Freshness: Recent · Last seen 11 days ago.

Detection rate: 52%
Threat type: trojan
Family: msil
Confidence: 100%
detection: 52 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 115afc8a426319ad5ffedb82cc4a338c08abd72ee7c5f7ef33c806ba16805328
SHA1: d940b20abd5d2fc651dc67cfbaffa4c41163c042
MD5: 62cf067f8dd3f7a8dee0073405e7846a
Filename: 69D5BRzlC3074655.eml
File type: email
MIME: message/rfc822
File size: 1965536
TLSH: T10795232D9E6D1BDE4D00E2FEBA13A84832CC22CB44D6576B02BD93B5B9F5434D257C62
SSDEEP: 24576:2piQeuq358toMl2WftaI/JHAkcrf/b9eKae3lQKIG//NCCL+oxvcUO8WPAbglGnO:SKgd9/JHaLcUDeEg/T
First seen: 2026-10-13T16:44:15Z
Last seen: 2026-10-29T16:33:12Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 52%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family msil.

Relationship context

13 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

14 timestamped observations are arranged from 2023-09-29 to 2051-12-15. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 52%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 13 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification msil

Classification context: type trojan, family msil.

Intelligence freshness Recent

Last seen 11 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 69D5BRzlC3074655.eml
File type: email
MIME: message/rfc822
Size: 1965536

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityobfuscatedpersistenceself-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
A document file initiated network communications indicative of a potential exploit or payload download
A document or script file initiated network communications indicative of a potential exploit or payload download
A file with an unusual extension was attempted to be loaded as a DLL.
A potential decoy document was displayed to the user

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1071 · T1221 — A document file initiated network communications indicative of a potential exploit or payload download
Tactics: TA0005 · TA0011
T1071 — A potential decoy document was displayed to the user
Tactics: TA0011
T1003 — Accessed credential storage registry keys
Tactics: TA0006
T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
B0030 — C2 Communication
Objectives: OB0004
B0001.002 — CheckRemoteDebuggerPresent
Objectives: OB0001
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity4

HTTP, TCPports 443, 6070

4 outbound connections observed
1 domains, 2 IPs, 1 URLs
Common ports: 443, 6070
Protocols: HTTP, TCP

View details · 3 shown

IP: 172.94.15.100
Port: 6070
Protocol: TCP

Domain: roaming.svc.cloud.microsoft
URL: https://roaming.svc.cloud.microsoft/rs/roamingsoapservice.svc
Protocol: HTTP

IP: 52.110.2.12
Port: 443
Protocol: TCP

DNS request activity1

A4 response IPs

1 DNS requests observed
1 unique queries
4 response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: roaming.svc.cloud.microsoft
Type: A
Answers: 52.110.2.76, 52.110.2.12, 52.110.2.67, 52.110.2.40
Response: NOERROR

C2 candidates1

TCPports 6070

1 C2 candidate communications
0 domains, 1 IPs
Common ports: 6070
Protocols: TCP

View details · 1 shown

IP: 172.94.15.100
Port: 6070
Protocol: TCP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check