- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
26909ab768e8a0472ae4dc2b06723082a26fb701c97cde3983bcd26e6347cffc- SHA1
0270c14f9534241a368c22c8999de3a122dfef2b- MD5
57a3685e9aeec3acfd4bd84f3695cc90- Filename
- 26909ab7_zk 6137_wys_2026.pdf.exe 2.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 506315
- Compile time
- 2025-09-11T12:48:37Z
- PE platform
- x64 64-bit
- PE sections
- 9
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 59%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections59%
VirusSign confidence100%
Relationship context13 visible
Threat classificationminix
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
50%
high
tar
507903 bytes
contains
Filename
d88bfb19_zk 6137_wys_2026.pdf (00000002).tar.bin
Family
minix
Type
trojan
File type
tar
MIME
application/x-tar
56%
high
tar
507904 bytes
contains
Filename
acb54613_2026.pdf.tar.bin
Family
minix
Type
trojan
File type
tar
MIME
application/x-tar
50%
high
email
744305 bytes
drops
Filename
60816f50_zapytanie ofertowe.eml.bin
Family
minix
Type
trojan
File type
email
MIME
message/rfc822
35%
high
email
745367 bytes
drops
Filename
31c98fa8_zapytanie ofertowe.eml.bin
Family
minix
Type
trojan
File type
email
MIME
message/rfc822
19%
low
email
743388 bytes
drops
Filename
02a0b8df_zapytanie ofertowe.mbox.bin
Family
mail
Type
malware
File type
email
MIME
application/mbox
Dropped / child files
Files dropped, bundled, or created by the queried file.
4shown
0%
text
17154 bytes
contains
Filename
28f5bfb5_hundelorts.bin
File type
text
MIME
text/plain
Size
17154
SHA1
3d2ad2a2f1b08261708498f6122aa63a57d4482e
0%
text
72 bytes
drops
Filename
dadf3daf_bacca.ini.bin
File type
text
MIME
text/plain
Size
72
SHA1
15702b8a732cb386278bb0b11eced7e3411bd7ad
4%
high
pedll
14336 bytes
contains
Filename
e336c0f9_1gs6jya.exe.bin
Type
trojan
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
14336
0%
pedll
25600 bytes
contains
Filename
29379ece_system.dll.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
25600
Compile time
2025-09-11T12:47:45Z
Related IPs
Network IPs associated with this indicator.
3shown
0%
US
communicates
CIDR
23.55.236.0/22
Network
23.32.0.0-23.67.255.255
First seen
2025-01-04T12:01:49Z
Last seen
2026-11-15T10:52:38Z
0%
US
communicates
CIDR
23.55.236.0/22
Network
23.32.0.0-23.67.255.255
First seen
2025-01-05T22:30:12Z
Last seen
2026-11-15T10:54:14Z
0%
US
communicates
CIDR
162.159.0.0/18
Network
162.158.0.0-162.159.255.255
First seen
2023-09-30T16:06:22Z
Last seen
2026-11-15T10:55:07Z
Related domains
Domains associated with this indicator.
1shown
0%
.net
communicates
Root
akamai.net
TLD
net
Subdomain
a1672.dscr
First seen
2025-05-29T12:07:07Z
Last seen
2026-11-15T10:55:07Z
Analysis details
Severity: hightrojan64bitexefile-overlaydebug-checkobfuscated
Freshness: Recent · Last seen 12 days ago.
- Detection rate
- 59%
- Threat type
- trojan
- Family
- minix
- Confidence
- 100%
- detection
- 59 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
26909ab768e8a0472ae4dc2b06723082a26fb701c97cde3983bcd26e6347cffc- SHA1
0270c14f9534241a368c22c8999de3a122dfef2b- MD5
57a3685e9aeec3acfd4bd84f3695cc90- Filename
- 26909ab7_zk 6137_wys_2026.pdf.exe 2.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 506315
- Compile time
- 2025-09-11T12:48:37Z
- PE platform
- x64 64-bit
- PE sections
- 9
- Import libraries
- 7
- TLSH
T103B40100EA937CFDD8F641B48EB78267E621BDA04424A21F1718BEBB7D705B2C917617- SSDEEP
12288:hrZugdqw8+mRlH4vW4aeXednwv+jMPfDSeHIIQSTI:hMgoH+8ALXeavG+LhHIVS8- Imphash
9be4f90f50c714bc00cc8beb2e137299- First seen
- 2026-10-12T16:50:26Z
- Last seen
- 2026-11-02T23:53:27Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 59%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family minix.
Relationship context
13 related indicators are shown across 4 relationship group(s).
Observation timeline
14 timestamped observations are arranged from 2023-09-30 to 2026-10-15. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family minix.
Last seen 12 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 26909ab7_zk 6137_wys_2026.pdf.exe 2.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 506315
- Compile time
- 2025-09-11T12:48:37Z
- PE platform
- x64 64-bit
- Entry point
- 17331
- Sections
- 9
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A PE section has a virtual size significantly larger than its raw size, consistent with packed code expanding into virtual memory at runtime
- AV process strings found (often used to terminate AV products)
- Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
- Authenticode signature is invalid
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1027 — A PE section has a virtual size significantly larger than its raw size, consistent with packed code expanding into virtual memory at runtimeTactics: TA0005
- T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patchingTactics: TA0004 · TA0005
- T1036 · T1553.002 — Authenticode signature is invalidTactics: TA0005 · TA0112
- T1548 — Found direct / indirect Syscall (likely to bypass EDR)Tactics: TA0004
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- C0032.001 — CRC32Objectives: OC0004
- E1510 — Clipboard ModificationObjectives: OB0008
- E1059 — Command and Scripting InterpreterObjectives: OB0009
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
UDPports 53
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 53
- Protocols: UDP
View details · 1 shown
- IP
- 162.159.36.2
- Port
- 53
- Protocol
- UDP
DNS request activity1
A2 response IPs
- 1 DNS requests observed
- 1 unique queries
- 2 response IPs
- Query types: A
- Response codes: NOERROR
View details · 1 shown
- Query
- a1672.dscr.akamai.net
- Type
- A
- Answers
- 23.55.236.136, 23.55.236.135
- Response
- NOERROR
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
- Compile time: 2025-09-11T12:48:37Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 17331
- Sections
- 9
- Compile time
- 2025-09-11T12:48:37Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: rw, r, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 37024
- Raw size
- 37376
- Permissions
- rx
- Entropy
- 6.25
- Name
- .data
- Virtual address
- 45056
- Virtual size
- 368
- Raw size
- 512
- Permissions
- rw
- Entropy
- 1.6
- Name
- .rdata
- Virtual address
- 49152
- Virtual size
- 35920
- Raw size
- 36352
- Permissions
- r
- Entropy
- 6.82
- Name
- .xdata
- Virtual address
- 86016
- Virtual size
- 1212
- Raw size
- 1536
- Permissions
- r
- Entropy
- 3.79
- Name
- .pdata
- Virtual address
- 90112
- Virtual size
- 1272
- Raw size
- 1536
- Permissions
- r
- Entropy
- 4.04
5 shown
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- ADVAPI32.dll
- Functions
- AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegDeleteValueW, RegEnumKeyW …
- Library
- COMCTL32.dll
- Functions
- ImageList_AddMasked, ImageList_Create, ImageList_Destroy, InitCommonControls
- Library
- GDI32.dll
- Functions
- CreateBrushIndirect, CreateFontIndirectW, DeleteObject, GetDeviceCaps, SelectObject, SetBkColor, SetBkMode, SetTextColor
- Library
- KERNEL32.dll
- Functions
- CloseHandle, CompareFileTime, CopyFileW, CreateDirectoryW, CreateFileW, CreateProcessW, CreateThread, DeleteFileW …
- Library
- ole32.dll
- Functions
- CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
5 shown
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_DIALOG, RT_BITMAP, RT_GROUP_ICON, RT_MANIFEST
View details · 5 shown
- Type
- RT_BITMAP
- Language
- ENGLISH US
- Type
- RT_ICON
- Language
- ENGLISH US
- Type
- RT_DIALOG
- Language
- ENGLISH US
- Type
- RT_GROUP_ICON
- Language
- ENGLISH US
- Type
- RT_VERSION
- Language
- ENGLISH US
5 shown