- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
1e99707c52a46be89c5942b691589a3632fa8b56b07f5ae806d4615b6bc94c36- SHA1
931f94f87fbc64c232e201b8d7d5e873e6ff0aa6- MD5
933e4e085baa21bb6233302c3909c176- Filename
- 1e99707c_gitportable_2.41.0.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 150158904
- TLSH
T10D683314B71D8CFFE913BF71AC9202A687B455EA5572F1163C6E02C7CB531883AAF906- SSDEEP
3145728:6coSuWLIEg3oqVfI5OATEw5uA6swIIxyxvM67aqismuooAydO8fb:7bSVy9EstIxyxdmuo5CD
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
6 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context6 visible
Intelligence freshnessAging
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
csv
1095 bytes
drops
Filename
c40ca014_fild4904b5744ecf245ed955c6292e69bbc.bin
File type
csv
MIME
text/plain
Size
1095
SHA1
50fda6c70a133cb64cf38aa4b2f313b54d2fd955
0%
text
115 bytes
drops
Filename
6ac0f184_iso2022-kr.enc.bin
File type
text
MIME
text/plain
Size
115
SHA1
94c5f39256366abb68cd67e3025f177f54ecd39d
0%
csv
1090 bytes
drops
Filename
e39985c6_filf7052c5e3973b334dbf63b8347845e33.bin
File type
csv
MIME
text/plain
Size
1090
SHA1
888499d9dfdf75c60c2770386a4500f35753ce70
0%
csv
1095 bytes
drops
Filename
71ae80ad_flsgiqumtxffefhikp99g4cn8iep1s.bin
File type
csv
MIME
text/plain
Size
1095
SHA1
e257bd16ef34fdc29d5b6c985a1b45801937354c
0%
csv
85574 bytes
drops
Filename
54639223_fil4229ae860b55fcdf1f8c1724c328f2bb.bin
File type
csv
MIME
text/plain
Size
85574
SHA1
bccc899015b688d5c426bc791c2fcde3a03a3eb5
Related IPs
Network IPs associated with this indicator.
1shown
0%
US
communicates
CIDR
142.250.0.0/15
Network
142.250.0.0-142.251.255.255
First seen
2023-09-30T17:25:18Z
Last seen
2026-11-14T18:02:22Z
Analysis details
embedded-executablezipadapter-discoveryprocess-renamedebug-checkinput-checkexec-delay
Freshness: Aging · Last seen 36 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
1e99707c52a46be89c5942b691589a3632fa8b56b07f5ae806d4615b6bc94c36- SHA1
931f94f87fbc64c232e201b8d7d5e873e6ff0aa6- MD5
933e4e085baa21bb6233302c3909c176- Filename
- 1e99707c_gitportable_2.41.0.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 150158904
- TLSH
T10D683314B71D8CFFE913BF71AC9202A687B455EA5572F1163C6E02C7CB531883AAF906- SSDEEP
3145728:6coSuWLIEg3oqVfI5OATEw5uA6swIIxyxvM67aqismuooAydO8fb:7bSVy9EstIxyxdmuo5CD- First seen
- 2024-08-11T11:45:20Z
- Last seen
- 2026-10-09T04:10:15Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
6 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
7 timestamped observations are arranged from 2009-04-09 to 2024-08-11. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map.
Intelligence freshness
Last seen 36 days ago. Revalidate volatile infrastructure before enforcement.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Last seen 36 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 1e99707c_gitportable_2.41.0.zip.bin
- File type
- zip
- MIME
- application/zip
- Size
- 150158904
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A named pipe was used for inter-process communication
- Allocates memory with a write watch (potentially for evading sandboxes)
- Binary contains a suspicious time stamp
- Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
- Checks available memory
5 shown
View MITRE ATT&CK details · 5 shown
- T1202 — Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.Tactics: TA0005
- T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.Tactics: TA0011
- T1106 — Adversaries may interact with the native OS application programming interface (API) to execute behaviors.Tactics: TA0002
- T1497 — Allocates memory with a write watch (potentially for evading sandboxes)Tactics: TA0005 · TA0007
- T1082 — An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.Tactics: TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- C0008 — Change Memory ProtectionObjectives: OC0002
- CommunicationObjectives: OC0006
- C0003.001 — Create PipeObjectives: OC0006
- B0001 — Debugger DetectionObjectives: OB0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
TCPports 443
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 443
- Protocols: TCP
View details · 1 shown
- IP
- 142.250.125.94
- Port
- 443
- Protocol
- TCP