Report - 1e5ed89a8f51…a59dd11a85

Malicious HighFILE

Quota 48

First seen: 2019-03-15T16:35:51Z
Last seen: 2026-03-07T00:11:24Z

THREAT SIGNALMedium Read alongside the verdict

CONFIDENCE96%VirusSign analysis

FAMILYalientrojan

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

SHA256: 1e5ed89a8f515a7de669340da9310f469c57348c2893bde8d36a75a59dd11a85
SHA1: 62408f8778dc7d3e632a2dbdd01b6558764ae092
MD5: 53a0b167baf0851114cfceb85b768b66
Filename: 1e5ed89a_output.73245055.txt.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 306024
Compile time: 2010-04-16T07:47:33Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

High-confidence evidence. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (25%).

Confidence signal

VirusSign reports 96% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections25%

VirusSign confidence96%

Relationship context20 visible

Threat classificationalien

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

2d65bbf7d8a2078436a1567a923fac7b042f02bbf24e5d480392a68981404653

4% low peexe 59392 bytes drops

Filename 2d65bbf7d8a2078436a1567a923fac7b042f02bbf24e5d480392a68981404653-dropped.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 59392 Compile time 2018-10-26T10:30:35Z

00427ca60761c3a27e71fd0b4ae8381a27543a930e4d79942dca97f694be6cff

4% low peexe 69632 bytes drops

Filename 00427ca6_e26y4vbmw.exe.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 69632 Compile time 2018-10-26T10:30:35Z

206c446e6aa838df20c8d37fb58341c36a80e8c73584cc997c48eed7e62d820b

0% xls 1374508 bytes drops

Filename 206c446e_~dfed6d98ae9626436f.tmp.bin File type xls MIME application/octet-stream Size 1374508 SHA1 70f70c3aa3f771375f60b9c2dc514f4422886c79

542caf0e26427017cfe3d835b95b35b3620eaf5a3ee7b6b5a6146aff1fb8fd31

0% text 21 bytes drops

Filename 542caf0e_2007lastupdate[1].txt.bin File type text MIME text/plain Size 21 SHA1 64c6d1c58810a2d70f363356e7646945e2a16890

1c104bdcf5a5c2ef0d577cbc5e2c40aa5e7c4642ce54acb31cd4fc2309ac6bba

0% 1164 bytes drops

MIME application/octet-stream Size 1164 SHA1 3279edc93fcf90134cd11d10cbb5b12f97b8e7e3 First seen 2024-01-29T05:31:23Z Last seen 2026-03-06T18:40:43Z

Related IPs

Network IPs associated with this indicator.

5shown

95.101.1.97

GB communicates

CIDR 95.101.0.0/21 First seen 2026-03-02T19:35:35Z Last seen 2026-03-02T19:35:35Z

93.90.55.218

FI communicates

CIDR 93.90.48.0/20 Network 93.90.55.1-93.90.55.254 First seen 2026-07-16T00:33:00Z Last seen 2026-07-16T00:33:00Z

91.90.49.27

FI communicates

First seen 2021-08-21T00:51:20Z Last seen 2026-03-06T18:40:44Z

91.90.49.26

FI communicates

Network 91.90.48.0-91.90.55.255 First seen 2026-04-28T19:36:29Z Last seen 2026-04-28T19:36:29Z

172.67.75.178

0% US communicates

CIDR 172.67.64.0/18 Network 172.64.0.0-172.71.255.255 First seen 2023-09-29T17:09:23Z Last seen 2026-11-11T02:32:11Z

Related domains

Domains associated with this indicator.

5shown

tuki.skj.fi

5% medium .fi communicates

Root skj.fi TLD fi Subdomain tuki First seen 2026-05-11T20:10:05Z Last seen 2026-05-12T11:50:33Z

tiedosto.skj.fi

5% low .fi communicates

Root skj.fi TLD fi Subdomain tiedosto First seen 2026-06-25T12:15:21Z Last seen 2026-06-25T12:15:21Z

skjsystems.atlassian.net

0% .net communicates

Root atlassian.net TLD net Subdomain skjsystems First seen 2025-02-15T21:52:27Z Last seen 2026-03-08T04:20:33Z

skj.fi

0% .fi communicates

Root skj.fi TLD fi First seen 2026-04-26T06:18:33Z Last seen 2026-05-09T15:49:48Z

confluence.skj.fi

0% .fi communicates

Root skj.fi TLD fi Subdomain confluence First seen 2026-05-12T06:13:37Z Last seen 2026-05-12T06:13:37Z

Related URLs

URLs associated with this indicator.

5shown

http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR+5mrncpqz/PiiIGRsF…

0% communicates

TLD org HTTP status 200 Content length 527 Content SHA256 d9dcde2b6f4c5c6e53f60b85275cd7e9c1498fdea8e177ade50ddb78cf854e82 First seen 2019-08-11T16:55:34Z

http://tiedosto.skj.fi/Misc/webcheck.exe

4% low communicates

TLD fi HTTP status 200 Content length 3248640 Content SHA256 2a3fa337c1ce6fb2802cbef5a29adc700f0cfdfda9fccce716eede9163343f0f First seen 2017-09-26T10:14:56Z

https://skjsystems.atlassian.net/wiki/spaces/WIKI/overview

0% communicates

TLD net HTTP status 200 Content length 28153 Content SHA256 2024bdc4c47945466e145e7920171cbb3a49f3d4919d585d58415eabad8b7309 First seen 2024-04-09T10:23:49Z

http://tuki.skj.fi/winskjupdate-s.exe

9% medium communicates

TLD fi HTTP status 200 Content length 1119024 Content SHA256 2a94024fcdfe70a047e976896b7cd4a78c693adbe609c41713ee2fcbb932757a First seen 2014-09-04T02:40:30Z

http://tuki.skj.fi/alphalastupdate.txt

4% low communicates

TLD fi HTTP status 200 Content length 24 Content SHA256 694e130b17d75a6c05e6eac4ad2e895a5dfe90f3c3848728c8593b4d49690c6d First seen 2014-09-03T04:42:23Z

Analysis details

Severity: hightrojanfile-overlayexecupxexedebug-checkobfuscatedsigned

Freshness: Historical · Last seen 252 days ago.

Detection rate: 25%
Threat type: trojan
Family: alien
Confidence: 96%
confidence: 96 · VirusSign confidence; engine detections are reported separately.

Overview

SHA256: 1e5ed89a8f515a7de669340da9310f469c57348c2893bde8d36a75a59dd11a85
SHA1: 62408f8778dc7d3e632a2dbdd01b6558764ae092
MD5: 53a0b167baf0851114cfceb85b768b66
Filename: 1e5ed89a_output.73245055.txt.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 306024
Compile time: 2010-04-16T07:47:33Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 16
TLSH: T1ED54224576099CC4E7FE8E3170D2DF7207B6B9EC5AA9921C9095F83732346232F9A2C5
SSDEEP: 6144:J1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59oC1By7nf:JjkArEN249AyE/rbaMct4bO2/VoV7f
Imphash: 77b2e5e9b52fbef7638f64ab65f0c58c
Richhash: 09983e500a3e996337593d644224f769
First seen: 2019-03-15T16:35:51Z
Last seen: 2026-03-07T00:11:24Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

High-confidence evidence. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (25%).

Confidence signal

VirusSign reports 96% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family alien.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2010-04-16 to 2026-07-16. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

Engine detections 25%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 96%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification alien

Classification context: type trojan, family alien.

Intelligence freshness Historical

Last seen 252 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 1e5ed89a_output.73245055.txt.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 306024
Compile time: 2010-04-16T07:47:33Z
PE platform: x86 32-bit
Entry point: 756624
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkexecobfuscated

View details · 5 shown

An executable file was downloaded
Attempts to connect to a dead IP:Port
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
Binary is likely a compiled AutoIt script file
Checks for mouse movement

5 shown

View MITRE ATT&CK details · 5 shown

T1071 — Attempts to connect to a dead IP:Port
Tactics: TA0011
T1497 — Checks for mouse movement
Tactics: TA0005 · TA0007
T1036 — Creates files inside the user directory
Tactics: TA0005
T1071 · T1105 — Downloads executable code via HTTP
Tactics: TA0011
T1071 · T1095 · T1105 — Downloads files from webservers via HTTP
Tactics: TA0011

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Communication
Objectives: OC0006
Defense Evasion
Objectives: OB0006
File System
Objectives: OC0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 80, 53

5+ outbound connections observed
5+ domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 53
Protocols: HTTP, TCP, UDP, ICMP

View details · 5 shown

Domain: tuki.skj.fi
URL: http://tuki.skj.fi/winskjupdate-s.exe
Protocol: HTTP

Domain: tuki.skj.fi
URL: http://tuki.skj.fi/lastupdate.txt
Protocol: HTTP

Domain: tuki.skj.fi
URL: http://tuki.skj.fi/d2007lastupdate.txt
Protocol: HTTP

Domain: tuki.skj.fi
URL: http://tuki.skj.fi/alphalastupdate.txt
Protocol: HTTP

Domain: tuki.skj.fi
URL: http://tuki.skj.fi/2007lastupdate.txt
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: tuki.skj.fi
Type: A
Answers: 91.90.49.26
Response: NOERROR

Query: tuki.skj.fi

Query: tiedosto.skj.fi
Type: A
Answers: 93.90.55.218
Response: NOERROR

Query: tiedosto.skj.fi
Type: A
Answers: 91.90.49.27
Response: NOERROR

Query: tiedosto.skj.fi

5 shown

C2 candidates1

HTTP

1 C2 candidate communications
1 domains, 0 IPs
Protocols: HTTP

View details · 1 shown

Domain: tuki.skj.fi
Protocol: HTTP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2010-04-16T07:47:33Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 756624
Sections: 3
Compile time: 2010-04-16T07:47:33Z

PE sections3

3 sections

3 PE sections
Common permissions: rwx, rw
3 unique section names

View details · 3 shown

Name: UPX0
Virtual address: 4096
Virtual size: 483328
Raw size: 0
Permissions: rwx
Entropy: 0.0

Name: UPX1
Virtual address: 487424
Virtual size: 270336
Raw size: 269824
Permissions: rwx
Entropy: 7.93

Name: .rsrc
Virtual address: 757760
Virtual size: 32768
Raw size: 30720
Permissions: rw
Entropy: 7.09

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.DLL
Functions: ExitProcess, GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, VirtualProtect

Library: ADVAPI32.dll
Functions: GetAce

Library: COMCTL32.dll
Functions: ImageList_Remove

Library: COMDLG32.dll
Functions: GetSaveFileNameW

Library: GDI32.dll
Functions: LineTo

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_ICON, RT_GROUP_ICON, RT_DIALOG, RT_MANIFEST

View details · 5 shown

Type: RT_ICON
Language: ENGLISH UK

Type: RT_MENU
Language: ENGLISH UK

Type: RT_DIALOG
Language: ENGLISH UK

Type: RT_STRING
Language: ENGLISH UK

Type: RT_STRING
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates3

2 issuers

Example subject: SKJ Systems Ltd Oy
Issued by: Entrust Code Signing CA - OVCS1
Validity period (UTC): 2019-03-12 – 2021-03-12

View details · 3 shown

Subject: SKJ Systems Ltd Oy
Issuer: Entrust Code Signing CA - OVCS1
Valid from: 1552385700.0
Valid to: 1615545900.0
Fingerprint: A4DC586981210DD5DA6404555F32D53A4A3C60A2

Subject: Entrust Code Signing CA - OVCS1
Issuer: Entrust Root Certification Authority - G2
Valid from: 1433943960.0
Valid to: 1920550560.0
Fingerprint: 995B8F2EA0FB7C1AC9CB2F7006033145253E9772

Subject: Entrust.net
Issuer: Entrust Root Certification Authority - G2
Valid from: 1246987500.0
Valid to: 1922896500.0
Fingerprint: 8CF427FD790C3AD166068DE81E57EFBB932272D4

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check