Report - 27847cbc989b…4bb892508d

Malicious HighFILE

Quota 32

First seen: 2026-11-02T16:36:13Z
Last seen: 2026-11-03T21:30:56Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYtedypua

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 27847cbc989b83013fd75a2f82c495114bccf6badeed6ec2fd5d5a4bb892508d
SHA1: 8086ae11d2a19456325bc20edc41f8d85982995e
MD5: 89dcf2ecce84cdc33141a1c1acb37924
Filename: vmware-workstation-pro-17-installer_O5-Hzi0.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 5474576
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
PE sections: 11

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 39%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections39%

VirusSign confidence100%

Relationship context16 visible

Threat classificationtedy

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

dcbab07aa57abc62b3c90ba58cbaa0bfb77d0bbed023203f4f00702a69eba9ec

5% medium peexe 4461056 bytes drops

Filename executable.tmp Family offercore Type pua File type peexe MIME application/vnd.microsoft.portable-executable

f6b86339ea9e79135202d66903e14a64c88b3d9ba3f0c7a6cb124412d44e637b

0% 73728 bytes contains

Filename .reloc MIME application/octet-stream Size 73728 SHA1 e97b93417956f4e6813d6d419b8a2856b357509b First seen 2026-04-17T06:37:07Z

a01c87dd7c465d0284faabb9f3e7446455e686aed92b7cc650b069f745fdf5e9

0% 6656 bytes contains

Filename .itext MIME application/octet-stream Size 6656 SHA1 af6a5c7a136572f0a4266cf3901ed9b2d717383a First seen 2026-04-17T06:44:13Z

4d485808295e129e85b6546e0a8973619f9bee700c6b60671d7ecd71b55843cc

0% 719360 bytes contains

Filename .text MIME application/octet-stream Size 719360 SHA1 0e58a8e84b1ccf14bea1848aad3276a06e9114a4 First seen 2026-04-17T06:48:10Z

f8bc31927074957901bc7975eec99aa54e759a66cbe2ca8bbbb16a2705caeedc

0% 512 bytes contains

Filename .rdata MIME application/octet-stream Size 512 SHA1 08fb7c36e037736171d75dff700936dd50e1e966 First seen 2026-04-17T06:33:38Z

Related IPs

Network IPs associated with this indicator.

5shown

18.160.71.26

0% US communicates

CIDR 18.160.64.0/21 Network 18.160.0.0-18.161.255.255 First seen 2025-03-14T14:03:49Z Last seen 2026-11-11T19:28:30Z

13.32.179.91

US communicates

CIDR 13.32.0.0/11 Network 13.32.0.0-13.33.255.255 First seen 2025-08-29T07:33:44Z Last seen 2026-11-11T19:28:30Z

3.171.171.75

0% US communicates

CIDR 3.128.0.0/10 Network 3.168.0.0-3.171.255.255 First seen 2024-11-20T21:47:03Z Last seen 2026-11-11T19:28:30Z

13.32.179.122

0% US communicates

CIDR 13.32.0.0/11 Network 13.32.0.0-13.33.255.255 First seen 2024-03-05T20:22:46Z Last seen 2026-11-11T19:28:30Z

3.171.171.91

0% US communicates

CIDR 3.128.0.0/10 Network 3.168.0.0-3.171.255.255 First seen 2024-11-16T05:36:07Z Last seen 2026-11-11T19:28:30Z

Related domains

Domains associated with this indicator.

5shown

d1p5nkjwocp3go.cloudfront.net

0% .net communicates

Root cloudfront.net TLD net Subdomain d1p5nkjwocp3go First seen 2026-04-13T22:57:36Z Last seen 2026-11-11T15:49:42Z

statusd.digitalcertvalidation.com

0% .com communicates

Root digitalcertvalidation.com TLD com Subdomain statusd First seen 2023-10-01T11:53:54Z Last seen 2026-11-11T20:16:10Z

digitalcertvalidation.com

0% .com communicates

Root digitalcertvalidation.com TLD com First seen 2023-10-01T08:14:13Z Last seen 2026-11-11T20:16:09Z

dl5.filehippo.com

0% .com communicates

Root filehippo.com TLD com Subdomain dl5 First seen 2023-09-30T11:31:11Z Last seen 2026-11-11T15:49:43Z

sc.filehippo.net

0% .net communicates

Root filehippo.net TLD net Subdomain sc First seen 2018-09-20T20:15:57Z Last seen 2026-11-11T19:35:50Z

Related URLs

URLs associated with this indicator.

1shown

http://statusd.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRNolijWxrE+4oss3hMF…

0% communicates

TLD com HTTP status 200 Content length 471 Content SHA256 10c520a5849ef636773ea8d5045352fcc1323fff257bb37a4d278460d26c15c6 First seen 2026-01-09T04:00:26Z

Analysis details

Severity: highpuaexefile-overlayself-deleteobfuscatedsigned

Freshness: Fresh · Last seen 7 days ago.

Detection rate: 39%
Threat type: pua
Family: tedy
Confidence: 100%
detection: 39 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 27847cbc989b83013fd75a2f82c495114bccf6badeed6ec2fd5d5a4bb892508d
SHA1: 8086ae11d2a19456325bc20edc41f8d85982995e
MD5: 89dcf2ecce84cdc33141a1c1acb37924
Filename: vmware-workstation-pro-17-installer_O5-Hzi0.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 5474576
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
PE sections: 11
Import libraries: 5
TLSH: T17146023BA18BE53EE07A5A353972911058FB7F6D65124C069AE4F84CCF360B01D3E6B6
SSDEEP: 98304:85OqMurURINHAa2JiCdJ9YKzoFOqQtAwKLoa2rMgq2A44D5kmg:Y/MaURXNYKzogqQtAwKLD2At2r4jg
Imphash: 88016fcdef7f227c62171d0afad9aae4
First seen: 2026-11-02T16:36:13Z
Last seen: 2026-11-03T21:30:56Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 39%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type pua and family tedy.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2018-09-20 to 2026-04-17. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 39%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification tedy

Classification context: type pua, family tedy.

Intelligence freshness Fresh

Last seen 7 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: vmware-workstation-pro-17-installer_O5-Hzi0.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 5474576
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
Entry point: 728672
Sections: 11

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscatedself-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
A PE executable (not DLL) exports symbols, which is unusual and may indicate a dual-mode loader or packer that exposes its own entry points
A file was accessed within the Public folder.
Authenticode signature is invalid
Checks available memory

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1027 — A PE executable (not DLL) exports symbols, which is unusual and may indicate a dual-mode loader or packer that exposes its own entry points
Tactics: TA0005
T1036 · T1548 — A file was accessed within the Public folder.
Tactics: TA0004 · TA0005
T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1082 — Checks available memory
Tactics: TA0007

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Communication
Objectives: OC0006
E1485 — Data Destruction
Objectives: OB0008
B0002 — Debugger Evasion
Objectives: OB0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, HTTPports 443

5+ outbound connections observed
1 domains, 5+ IPs, 2 URLs
Common ports: 443
Protocols: TCP, HTTP

View details · 5 shown

IP: 107.167.125.189
Port: 443
Protocol: TCP

Domain: statusd.digitalcertvalidation.com
URL: http://statusd.digitalcertvalidation.com/mfewtzbnmeswstajbgurdgmcgguabbrnolijwxre+4oss3hmfe8heagz1aqu9vyih9m/a1kkurdhas3a4vdn6egceaav2cvjf8+y2vz6cgdvsuk=
Protocol: HTTP

Domain: statusd.digitalcertvalidation.com
URL: http://statusd.digitalcertvalidation.com/mfewtzbnmeswstajbgurdgmcgguabbrnolijwxre%2b4oss3hmfe8heagz1aqu9vyih9m%2fa1kkurdhas3a4vdn6egceaav2cvjf8%2by2vz6cgdvsuk%3d
Protocol: HTTP

IP: 3.171.171.31
Port: 443
Protocol: TCP

IP: 3.170.83.199
Port: 443
Protocol: TCP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: update.reasonsecurity.com
Type: A
Answers: 18.160.71.86, 18.160.71.111, 18.160.71.75, 18.160.71.26
Response: NOERROR

Query: statusd.digitalcertvalidation.com

Query: shield.reasonsecurity.com
Type: A
Answers: 3.170.73.90, 3.170.73.2, 3.170.73.3, 3.170.73.34
Response: NOERROR

Query: sc.filehippo.net
Type: A
Answers: 151.101.193.91, 151.101.1.91, 151.101.129.91, 151.101.65.91
Response: NOERROR

Query: pac.rlinfraservices.com
Type: A
Answers: 13.32.179.18, 13.32.179.91, 13.32.179.122, 13.32.179.42
Response: NOERROR

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 2026-02-11T11:40:27Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 728672
Sections: 11
Compile time: 2026-02-11T11:40:27Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: rw, r, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 718860
Raw size: 719360
Permissions: rx
Entropy: 6.38

Name: .itext
Virtual address: 724992
Virtual size: 6348
Raw size: 6656
Permissions: rx
Entropy: 6.04

Name: .data
Virtual address: 733184
Virtual size: 16188
Raw size: 16384
Permissions: rw
Entropy: 5.18

Name: .bss
Virtual address: 749568
Virtual size: 29516
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .idata
Virtual address: 782336
Virtual size: 4200
Raw size: 4608
Permissions: rw
Entropy: 4.82

5 shown

Imports5

5 DLL groups

5 import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: kernel32.dll
Functions: CloseHandle, CompareStringOrdinal, CompareStringW, CreateDirectoryW, CreateEventW, CreateFileW, CreateProcessW, CreateThread …

Library: comctl32.dll
Functions: InitCommonControls

Library: user32.dll
Functions: CallWindowProcW, CharLowerBuffW, CharNextW, CharUpperBuffW, CharUpperW, CreateWindowExW, DestroyWindow, DispatchMessageW …

Library: oleaut32.dll
Functions: SafeArrayAccessData, SafeArrayCreate, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayUnaccessData …

Library: advapi32.dll
Functions: AdjustTokenPrivileges, AllocateAndInitializeSid, ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, EqualSid, FreeSid, GetTokenInformation, LookupPrivilegeValueW …

Exports2

2 exported items

2 exported items

View details · 2 shown

Name: __dbk_fcall_wrapper

Name: dbkFCallWrapperAddr

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_MANIFEST

View details · 5 shown

Type: RT_ICON
Language: ENGLISH US

Type: RT_STRING
Language: NEUTRAL

Type: RT_RCDATA
Language: NEUTRAL

Type: RT_RCDATA
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5 issuers

Example subject: KOPETRA LTD
Issued by: Sectigo Public Code Signing CA EV R36
Validity period (UTC): 2026-01-27 – 2027-01-27

View details · 5 shown

Subject: KOPETRA LTD
Issuer: Sectigo Public Code Signing CA EV R36
Valid from: 1769472000.0
Valid to: 1801094340.0
Fingerprint: 397BAB93570DA8EBB85D8E1017C9FB8249025A0C

Subject: Sectigo Public Code Signing CA EV R36
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2089756740.0
Fingerprint: 0185FF9961FF0AA2E431817948C28E83D3F3EC70

Subject: Sectigo Public Code Signing Root R46
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2405289540.0
Fingerprint: CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check