- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
2b1d529b644cd0a5be8ae128015f612a36762b2a9dc744b852ce3ba684dedf2c- SHA1
bfd136f72fb55524313d8a59348db37dfd9cee3b- MD5
d4b575497b53ecb4bcc8d2b3ae286058- Filename
- vt-upload-bEmIV
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 85360
- Compile time
- 2013-03-22T06:44:02Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 14. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 81%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections81%
VirusSign confidence100%
Relationship context14 visible
Threat classificationeggdrop
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
2shown
78%
critical
pedll
94208 bytes
contains
Filename
Black.dll
Family
nitol
Type
trojan
File type
pedll
MIME
application/vnd.microsoft.portable-executable
81%
high
peexe
85360 bytes
drops
Filename
vt-upload-bEmIV
Family
eggdrop
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
78%
critical
pedll
94208 bytes
drops
Filename
Black.dll
Family
nitol
Type
trojan
File type
pedll
MIME
application/vnd.microsoft.portable-executable
81%
high
peexe
85360 bytes
drops
Filename
vt-upload-bEmIV
Family
eggdrop
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
68%
high
peexe
15360 bytes
drops
Filename
passthru.1.sys
Family
servstart
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
5%
low
372 bytes
drops
Filename
install.bat1
MIME
application/x-msdos-program
Size
372
SHA1
bf1c833f0d625e860e28c2ce87696131057c0391
First seen
2013-04-17T10:53:56Z
0%
text
5468 bytes
drops
Filename
103
File type
text
MIME
text/plain
Size
5468
SHA1
1b891237c057eed3508867456fd354a679c355c9
Related IPs
Network IPs associated with this indicator.
5shown
ZA
communicates
CIDR
168.76.0.0/17
First seen
2026-06-14T22:53:19Z
Last seen
2026-06-19T20:32:36Z
5%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2025-11-25T06:34:55Z
Last seen
2026-11-13T10:23:26Z
5%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2025-12-29T07:34:23Z
Last seen
2026-11-13T10:12:25Z
5%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2025-12-08T01:12:33Z
Last seen
2026-11-13T10:37:03Z
5%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2025-12-06T19:44:43Z
Last seen
2026-11-13T10:37:48Z
Related domains
Domains associated with this indicator.
2shown
.com
communicates
Root
1129809.com
TLD
com
Subdomain
www
First seen
2026-05-23T14:22:35Z
Last seen
2026-06-18T13:52:28Z
0%
.com
communicates
Root
live.com
TLD
com
Subdomain
nexusrules.officeapps
First seen
2023-09-29T01:11:46Z
Last seen
2026-11-13T10:38:50Z
Analysis details
Severity: hightrojanfile-overlayexepecompactpolymorphicobfuscatedsigned
Freshness: Aging · Last seen 137 days ago.
- Detection rate
- 81%
- Threat type
- trojan
- Family
- eggdrop
- Confidence
- 100%
- detection
- 81 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
2b1d529b644cd0a5be8ae128015f612a36762b2a9dc744b852ce3ba684dedf2c- SHA1
bfd136f72fb55524313d8a59348db37dfd9cee3b- MD5
d4b575497b53ecb4bcc8d2b3ae286058- Filename
- vt-upload-bEmIV
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 85360
- Compile time
- 2013-03-22T06:44:02Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 1
- TLSH
T14583F2970F1654B6D4921D30C6EC8DF98DF5B28B3CC6206FD19844766E8AB642F90D33- SSDEEP
1536:YGF+EhLd0Dt2ULlBwL9EyQvXtyiH/7P8p4ftiyfEro5x0TIICuwNHBx1W4ixAEWS:t3hBMt2ULYJEyitH/i4fRow0tBwNhGxz- Imphash
09d0478591d4f788cb3e5ea416c25237- Richhash
fca5a237ac5323f850d0da98e513e584- First seen
- 2014-08-18T00:56:31Z
- Last seen
- 2026-06-29T09:36:45Z
- Filename variants
- 3 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 14. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 81%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family eggdrop.
Relationship context
14 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
12 timestamped observations are arranged from 2011-07-17 to 2026-06-14. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family eggdrop.
Last seen 137 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- vt-upload-bEmIV
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 85360
- Compile time
- 2013-03-22T06:44:02Z
- PE platform
- x86 32-bit
- Entry point
- 212992
- Sections
- 3
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
- Binary contains paths to debug symbols
- Binary may include packed or encrypted code
- Classification label
- Creates RWX memory
5 shown
View MITRE ATT&CK details · 5 shown
- T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patchingTactics: TA0004 · TA0005
- T1027.002 — Binary may include packed or crypted dataTactics: TA0005
- T1036 — Creates files inside the system directoryTactics: TA0005
- T1543.003 — Creates or modifies windows servicesTactics: TA0003 · TA0004
- T1059 · T1129 — Loads a new DLL where the caller address originates from dynamically allocated (unbacked) memoryTactics: TA0002
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- CommunicationObjectives: OC0006
- Defense EvasionObjectives: OB0006
- C0002 — HTTP CommunicationObjectives: OC0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity3
UDP, TCPports 53, 8005
- 3 outbound connections observed
- 0 domains, 3 IPs, 0 URLs
- Common ports: 53, 8005
- Protocols: UDP, TCP
View details · 3 shown
- IP
- 8.8.8.8
- Port
- 53
- Protocol
- UDP
- IP
- <MACHINE_DNS_SERVER>
- Port
- 53
- Protocol
- UDP
- IP
- 168.76.50.60
- Port
- 8005
- Protocol
- TCP
DNS request activity3
A5+ response IPs
- 3 DNS requests observed
- 2 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 3 shown
- Query
- www.1129809.com
- Type
- A
- Answers
- 222.240.21.104
- Response
- NOERROR
- Query
- www.1129809.com
- Type
- A
- Answers
- 168.76.50.60
- Response
- NOERROR
- Query
- nexusrules.officeapps.live.com
- Type
- A
- Answers
- 150.171.109.115, 13.107.253.57, 150.171.109.184, 13.107.253.40, 13.107.253.70, 150.171.109.146, 150.171.109.178, 13.107.226.40
- Response
- NOERROR
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2013-03-22T06:44:02Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 212992
- Sections
- 3
- Compile time
- 2013-03-22T06:44:02Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: rwx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 204800
- Raw size
- 73216
- Permissions
- rwx
- Entropy
- 7.99
- Name
- .rsrc
- Virtual address
- 208896
- Virtual size
- 4096
- Raw size
- 4096
- Permissions
- rwx
- Entropy
- 7.08
- Name
- New4
- Virtual address
- 212992
- Virtual size
- 512
- Raw size
- 512
- Permissions
- rwx
- Entropy
- 0.67
Imports1
1 DLL groups
- 1 import DLL groups
- 4 imported functions summarized
View details · 1 shown
- Library
- kernel32.dll
- Functions
- GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree
Resources5
5 resources
- 5 resources
- Resource types: BIN
View details · 1 shown
- Type
- BIN
- Language
- CHINESE SIMPLIFIED
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates3
3 issuers
- Example subject: Symantec Time Stamping Services Signer - G3
- Issued by: VeriSign Time Stamping Services CA
View details · 3 shown
- Subject
- Symantec Time Stamping Services Signer - G3
- Issuer
- VeriSign Time Stamping Services CA
- Fingerprint
- 23C4271D605CB2787A3A85D90282852D7B6B9981
- Subject
- VeriSign Time Stamping Services CA
- Issuer
- Thawte Timestamping CA
- Fingerprint
- F46AC0C6EFBB8C6A14F55F09E2D37DF4C0DE012D
- Subject
- ESTsoft Corp.
- Issuer
- VeriSign Class 3 Code Signing 2010 CA
- Fingerprint
- 0402C76D533DBBB7C146E62DDC9BFB64BEDCCBB0