- First seen
- Last seen
THREAT SIGNALLow
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
16ae9e505da7b119c29072cb69cef66dc94683222b07021fb1e3434e8519e960- SHA1
5c6716a92191ceff9bca4429ec670b828fcc0940- MD5
f2b281e38475d5a172ce1392de5cbc69- Filename
- 16ae9e50_2_00004dez.dll.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 435712
- Compile time
- 1992-06-19T22:22:17Z
- PE platform
- x86 32-bit
- PE sections
- 7
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Relationship context
18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections4%
Relationship context18 visible
Intelligence freshnessAging
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
4shown
0%
cab
28456059 bytes
contains
File type
cab
MIME
application/vnd.ms-cab-compressed
Size
28456059
SHA1
11371f7396e3d5e0d2da12dce96b5def6e53fa05
First seen
2022-04-29T07:46:13Z
5%
high
cab
4545706 bytes
contains
Filename
4346ad60_data1.cab.bin
Type
spyware
File type
cab
MIME
application/vnd.ms-cab-compressed
Size
4545706
5%
high
rar
3823057 bytes
contains
Filename
7d9acf43_macraigor-prog.rar.bin
Type
spyware
File type
rar
MIME
application/vnd.rar
Size
3823057
0%
peexe
1256365 bytes
contains
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
1256365
Compile time
2007-09-29T12:50:37Z
SHA1
a061ab94affc8d156b160e3bfba7f74b72bf56a8
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
bmp
478 bytes
contains
Filename
be6c59e4_wwclose.bmp.bin
File type
bmp
MIME
application/octet-stream
Size
478
SHA1
97fe36d7a4d2d6e448092a1693917eb637804a77
0%
bmp
478 bytes
contains
Filename
e3a836db_wwwhelp.bmp.bin
File type
bmp
MIME
application/octet-stream
Size
478
SHA1
2bf4610daa42dbcfdffcc98af565d6436ad559ba
0%
bmp
478 bytes
contains
Filename
2ffe79a5_lbabort.bmp.bin
File type
bmp
MIME
application/octet-stream
Size
478
SHA1
ec64707de2c84114aeb0f8bd431adce95c3a2757
0%
236 bytes
contains
Filename
55465668_4075.bin
MIME
application/octet-stream
Size
236
SHA1
461e3ec886ac47995c794ad19d7c5c4f43d6c6cf
First seen
2013-02-21T22:17:09Z
0%
ico
20 bytes
contains
Filename
ff04c16f_500.bin
File type
ico
MIME
application/octet-stream
Size
20
SHA1
cf9a68a0b175f131381d3d29245441a6f9d53e3d
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
23.11.32.0/21
Network
23.0.0.0-23.15.255.255
First seen
2026-03-02T13:22:00Z
Last seen
2026-11-14T00:11:24Z
5%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2025-12-08T01:12:33Z
Last seen
2026-11-14T00:01:06Z
6%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.0.0.0-150.255.255.255
First seen
2026-03-03T10:37:40Z
Last seen
2026-11-14T00:02:42Z
0%
US
communicates
CIDR
13.107.224.0/20
Network
13.64.0.0-13.107.255.255
First seen
2023-10-01T20:12:32Z
Last seen
2026-11-13T08:10:49Z
0%
US
communicates
CIDR
13.107.252.0/23
Network
13.64.0.0-13.107.255.255
First seen
2023-09-29T21:07:53Z
Last seen
2026-11-13T23:59:41Z
Related domains
Domains associated with this indicator.
4shown
0%
.net
communicates
Root
akahost.net
TLD
net
Subdomain
eip-terr-na.cdp1.digicert.com
First seen
2026-01-02T13:32:37Z
Last seen
2026-11-14T00:11:31Z
0%
.com
communicates
Root
live.com
TLD
com
Subdomain
nexusrules.officeapps
First seen
2023-09-29T01:11:46Z
Last seen
2026-11-14T00:11:31Z
0%
.net
communicates
Root
akamai.net
TLD
net
Subdomain
a1672.dscr
First seen
2025-05-29T12:07:07Z
Last seen
2026-11-14T00:11:31Z
0%
.com
communicates
Root
bing.com
TLD
com
Subdomain
www
First seen
2023-09-30T04:11:06Z
Last seen
2026-11-14T00:11:41Z
Analysis details
Severity: lowdllobfuscated
Freshness: Aging · Last seen 44 days ago.
- Detection rate
- 4%
- detection
- 4 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
16ae9e505da7b119c29072cb69cef66dc94683222b07021fb1e3434e8519e960- SHA1
5c6716a92191ceff9bca4429ec670b828fcc0940- MD5
f2b281e38475d5a172ce1392de5cbc69- Filename
- 16ae9e50_2_00004dez.dll.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 435712
- Compile time
- 1992-06-19T22:22:17Z
- PE platform
- x86 32-bit
- PE sections
- 7
- Import libraries
- 9
- TLSH
T159946D26F2E08837C137697C9C1B97A4A939BE513E2CAD463BE41D8C5F3978135292D3- SSDEEP
12288:BMn/7oCsWnBv01t2kE7EL7v0Uan+sGVm0m:m/rsWnpzZYLna+U- Imphash
f16aeed3288397958f9704c36e299183- First seen
- 2009-11-01T01:02:56Z
- Last seen
- 2026-09-30T20:46:42Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Relationship context
18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
19 timestamped observations are arranged from 1992-06-19 to 2026-03-03. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Intelligence freshness
Last seen 44 days ago. Revalidate volatile infrastructure before enforcement.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
4 relationship group(s) provide pivot and infrastructure context.
Last seen 44 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 16ae9e50_2_00004dez.dll.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 435712
- Compile time
- 1992-06-19T22:22:17Z
- PE platform
- x86 32-bit
- Entry point
- 372760
- Sections
- 7
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Classification label
- Creates mutexes
- Performs DNS lookups
- Possible date expiration check, exits too soon after checking local time
- Queries process token information to check for Administrator privileges or UAC elevation status
5 shown
View MITRE ATT&CK details · 3 shown
- T1033 · T1082 — Queries process token information to check for Administrator privileges or UAC elevation statusTactics: TA0007
- T1027 — The PE entry point is located unusually far into section, indicative of an appended packer stub that jumps to the original entry point (OEP)Tactics: TA0005
- T1027.002 — The binary contains an unknown PE section name indicative of packingTactics: TA0005
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- CommunicationObjectives: OC0006
- Defense EvasionObjectives: OB0006
- C0002 — HTTP CommunicationObjectives: OC0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
UDPports 53
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 53
- Protocols: UDP
View details · 1 shown
- IP
- 162.159.36.2
- Port
- 53
- Protocol
- UDP
DNS request activity4
A5+ response IPs
- 4 DNS requests observed
- 4 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 4 shown
- Query
- www.bing.com
- Type
- A
- Answers
- 23.33.29.200, 23.33.29.203, 23.33.29.198, 23.33.29.199, 23.33.29.214, 23.33.29.205, 23.33.29.207
- Response
- NOERROR
- Query
- nexusrules.officeapps.live.com
- Type
- A
- Answers
- 13.107.226.70, 13.107.226.51, 150.171.109.73, 13.107.226.57, 13.107.253.70, 150.171.109.146, 13.107.253.41, 13.107.253.57
- Response
- NOERROR
- Query
- eip-terr-na.cdp1.digicert.com.akahost.net
- Type
- A
- Answers
- 23.11.32.159
- Response
- NOERROR
- Query
- a1672.dscr.akamai.net
- Type
- A
- Answers
- 23.195.81.73, 23.195.81.59
- Response
- NOERROR
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit5+ sections
- Platform: x86 32-bit
- Sections: 5+
- Entry point: present
- Compile time: 1992-06-19T22:22:17Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 372760
- Sections
- 7
- Compile time
- 1992-06-19T22:22:17Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: rs, rw, rx
- 5+ unique section names
View details · 5 shown
- Name
- CODE
- Virtual address
- 4096
- Virtual size
- 368688
- Raw size
- 369152
- Permissions
- rx
- Entropy
- 6.54
- Name
- DATA
- Virtual address
- 376832
- Virtual size
- 5388
- Raw size
- 5632
- Permissions
- rw
- Entropy
- 4.74
- Name
- BSS
- Virtual address
- 385024
- Virtual size
- 1093437
- Raw size
- 0
- Permissions
- rw
- Entropy
- 0.0
- Name
- .idata
- Virtual address
- 1478656
- Virtual size
- 9268
- Raw size
- 9728
- Permissions
- rw
- Entropy
- 4.91
- Name
- .edata
- Virtual address
- 1490944
- Virtual size
- 909
- Raw size
- 1024
- Permissions
- rs
- Entropy
- 4.81
5 shown
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- kernel32.dll
- Functions
- CloseHandle, CompareStringA, CreateEventA, CreateFileA, CreateThread, DeleteCriticalSection, EnterCriticalSection, EnumCalendarInfoA …
- Library
- user32.dll
- Functions
- ActivateKeyboardLayout, AdjustWindowRectEx, BeginPaint, CallNextHookEx, CallWindowProcA, CharLowerA, CharLowerBuffA, CharNextA …
- Library
- advapi32.dll
- Functions
- RegCloseKey, RegOpenKeyExA, RegQueryValueExA
- Library
- oleaut32.dll
- Functions
- SafeArrayCreate, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SysAllocStringLen, SysFreeString, SysReAllocStringLen, VariantChangeType …
- Library
- version.dll
- Functions
- GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
5 shown
Exports5+
5+ exported items
- 5+ exported items
View details · 5 shown
- Name
- Jtag_BdmShift
- Name
- Jtag_ResetTap
- Name
- bdm_shift
- Name
- get_state
- Name
- init_jtag_controller
5 shown
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_STRING, RT_BITMAP, RT_CURSOR, RT_GROUP_CURSOR, RT_RCDATA
View details · 5 shown
- Type
- RT_CURSOR
- Language
- NEUTRAL
- Type
- RT_BITMAP
- Language
- NEUTRAL
- Type
- RT_ICON
- Language
- ENGLISH US
- Type
- RT_DIALOG
- Language
- NEUTRAL
- Type
- RT_STRING
- Language
- NEUTRAL
5 shown