Report - 2d05a9b01b7c…093cdcc496

Malicious HighFILE

Quota 18

First seen: 2024-09-05T05:10:11Z
Last seen: 2025-02-01T20:36:49Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmsiltrojan

RELATED INDICATORS13Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 2d05a9b01b7c2c9b22ad53f94aea85a3144c4b466e23fde39109e2093cdcc496
SHA1: 12283d629ca6bafbbe5d3319da37925baa48bc41
MD5: 1a30dfd06f4a4c9c5e02e133438ac65e
Filename: 2d05a9b0_sgfz.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 712200
Compile time: 2024-04-15T23:34:05Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 62%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections62%

VirusSign confidence100%

Relationship context13 visible

Threat classificationmsil

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

13 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

3shown

220ca80076450c74006be5ec302bb3e44bcae301ddc343decd171fc0f45ab37d

0% cab 13832 bytes contains

Filename 220ca800_[0].bin File type cab MIME application/vnd.ms-cab-compressed Size 13832 SHA1 42f7eb6f3950acd4a5f53fc2bb071bacd9ef0071

a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

0% 64 bytes drops

Filename a7de5177_startupprofiledata-noninteractive.bin MIME application/octet-stream Size 64 SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799 First seen 2014-08-19T15:29:21Z

539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a

0% xml 490 bytes contains

Filename 539dc26a_manifest_1-x0.xml.bin File type xml MIME application/xml Size 490 SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734

Related IPs

Network IPs associated with this indicator.

5shown

162.241.224.14

5% low US communicates

CIDR 162.241.224.0/21 Network 162.240.0.0-162.241.255.255 First seen 2023-09-30T11:38:07Z Last seen 2026-10-29T16:33:26Z

69.164.0.128

0% US communicates

Network 69.164.0.0-69.164.63.255 First seen 2023-09-29T02:22:05Z Last seen 2026-11-14T10:16:32Z

152.195.19.97

0% US communicates

CIDR 152.195.0.0/16 Network 152.195.0.0-152.195.255.255 First seen 2023-09-30T12:07:05Z Last seen 2026-11-14T11:40:41Z

192.168.0.61

0% communicates

First seen 2022-12-16T03:27:56Z Last seen 2026-11-14T20:00:01Z

208.95.112.1

5% low US communicates

CIDR 208.95.112.0/22 Network 208.95.112.0-208.95.115.255 First seen 2023-09-30T15:26:15Z Last seen 2026-11-14T20:00:18Z

Related domains

Domains associated with this indicator.

5shown

mail.keeptraveling-eg.com

5% medium .com communicates

Root keeptraveling-eg.com TLD com Subdomain mail First seen 2018-11-19T15:46:47Z Last seen 2026-11-11T14:29:44Z

ip-api.com

5% low .com communicates

Root ip-api.com TLD com First seen 2023-09-30T15:26:15Z Last seen 2026-11-14T20:00:19Z

api.ipify.org

0% .org communicates

Root ipify.org TLD org Subdomain api First seen 2023-10-01T04:34:19Z Last seen 2026-11-14T19:32:58Z

res.public.onecdn.static.microsoft

0% .microsoft communicates

Root static.microsoft TLD microsoft Subdomain res.public.onecdn First seen 2024-03-22T22:43:31Z Last seen 2026-11-14T20:00:46Z

www.microsoft.com

0% .com communicates

Root microsoft.com TLD com Subdomain www First seen 2023-09-29T15:40:06Z Last seen 2026-11-14T20:00:48Z

Analysis details

Severity: hightrojaninvalid-signaturepolymorphicfile-overlayexedotnetsmtpsigned

Freshness: Historical · Last seen 650 days ago.

Detection rate: 62%
Threat type: trojan
Family: msil
Confidence: 100%
detection: 62 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 2d05a9b01b7c2c9b22ad53f94aea85a3144c4b466e23fde39109e2093cdcc496
SHA1: 12283d629ca6bafbbe5d3319da37925baa48bc41
MD5: 1a30dfd06f4a4c9c5e02e133438ac65e
Filename: 2d05a9b0_sgfz.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 712200
Compile time: 2024-04-15T23:34:05Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T173E40284B7F8AF42E4B94BF95660600A47F2B80B3171D74E6CC560CE6EB2B409B50F67
SSDEEP: 12288:6LnteoiolqxJHBNaeuyPwF9dWlEK5v8XMdStkBJT9CkR:weoioWBkHyPmDWlEu8XMAtQxx
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2024-09-05T05:10:11Z
Last seen: 2025-02-01T20:36:49Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 13. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 62%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family msil.

Relationship context

13 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

14 timestamped observations are arranged from 2014-08-19 to 2024-04-24. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 62%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 13 visible

3 relationship group(s) provide pivot and infrastructure context.

Threat classification msil

Classification context: type trojan, family msil.

Intelligence freshness Historical

Last seen 650 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 2d05a9b0_sgfz.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 712200
Compile time: 2024-04-15T23:34:05Z
PE platform: x86 32-bit
Entry point: 694818
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

smtp

View details · 5 shown

access .NET resource
compiled to the .NET platform
hash data using SHA256
invoke .NET assembly method
reference SQL statements

5 shown

View MITRE ATT&CK details · 2 shown

T1620 — invoke .NET assembly method
Tactics: TA0005
T1213 — reference SQL statements
Tactics: TA0009

View MBC details · 2 shown

B0013.001 — Process detection
Objectives: OB0007
C0029.003 — SHA256
Objectives: OC0005

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDPports 80, 443, 137

5+ outbound connections observed
0 domains, 5+ IPs, 0 URLs
Common ports: 80, 443, 137, 53
Protocols: TCP, UDP

View details · 5 shown

IP: 8.8.8.8
Port: 53
Protocol: UDP

IP: 208.95.112.1
Port: 80
Protocol: TCP

IP: 199.232.210.172
Port: 80
Protocol: TCP

IP: 69.164.0.128
Port: 80
Protocol: TCP

IP: 23.216.81.152
Port: 80
Protocol: TCP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: mail.keeptraveling-eg.com
Type: A
Answers: 162.241.224.14
Response: NOERROR

Query: ip-api.com
Type: A
Answers: 208.95.112.1
Response: NOERROR

Query: www.microsoft.com
Type: A
Answers: 23.216.81.152
Response: NOERROR

Query: res.public.onecdn.static.microsoft
Type: A
Answers: 152.195.19.97
Response: NOERROR

Query: api.ipify.org
Type: A
Answers: 104.26.13.205, 104.26.12.205, 172.67.74.152
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2024-04-15T23:34:05Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 694818
Sections: 3
Compile time: 2024-04-15T23:34:05Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 686656
Raw size: 688128
Permissions: rx
Entropy: 7.91

Name: .rsrc
Virtual address: 696320
Virtual size: 6076
Raw size: 6144
Permissions: r
Entropy: 7.09

Name: .reloc
Virtual address: 704512
Virtual size: 12
Raw size: 2048
Permissions: r
Entropy: 0.03

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Resources4

4 resources

4 resources
Resource types: RT_GROUP_ICON, RT_ICON, RT_MANIFEST, RT_VERSION

View details · 4 shown

Type: RT_ICON
Language: NEUTRAL

Type: RT_GROUP_ICON
Language: NEUTRAL

Type: RT_VERSION
Language: NEUTRAL

Type: RT_MANIFEST
Language: NEUTRAL

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates4

3 issuers

Example subject: Simon Tatham
Issued by: COMODO RSA Code Signing CA
Validity period (UTC): 2018-11-13 – 2021-11-08

View details · 5 shown

Subject: Simon Tatham
Issuer: COMODO RSA Code Signing CA
Valid from: 1542067200.0
Valid to: 1636415940.0
Fingerprint: 5B9E273CF11941FD8C6BE3F038C4797BBE884268

Subject: COMODO RSA Code Signing CA
Issuer: COMODO RSA Certification Authority
Valid from: 1368057600.0
Valid to: 1841443140.0
Fingerprint: B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47

Subject: Sectigo (formerly Comodo CA)
Issuer: COMODO RSA Certification Authority
Valid from: 1263859200.0
Valid to: 2147471940.0
Fingerprint: AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4

Subject: COMODO RSA Certification Authority
Issuer: COMODO RSA Certification Authority
Fingerprint: AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4

Subject: COMODO SHA-1 Time Stamping Signer
Issuer: UTN-USERFirst-Object
Fingerprint: 03A5B14663EB12023091B84A6D6A68BC871DE66B

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check