Report - 2ec0a17c0b8d…d9d73a463c

Malicious CriticalFILE

Quota 40

First seen: 2026-11-09T12:03:04Z
Last seen: 2026-11-09T17:49:35Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmsiltrojan

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 2ec0a17c0b8dafa0cb5748d0ebf0162c5cb058b259d5b70e204723d9d73a463c
SHA1: 93adeef529b363e997dd0ff1870d7b93e69de2b8
MD5: bfb7ad141717e2dfe2b1cfc055c6f323
Filename: 2ec0a17c_ovtzfyxz.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1617920
Compile time: 2048-07-21T17:05:59Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 65%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections65%

VirusSign confidence100%

Relationship context20 visible

Threat classificationmsil

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

23bd2fa5a45e327818044778e85f2f29eb06f8e66ebdf24f477a7cd8486f7090

0% csv 1362 bytes drops

Filename 23bd2fa5_executable.exe.log.bin File type csv MIME text/plain Size 1362 SHA1 48293f7c1ff841f9ffc4c5d01acfbcd6e08a560a

fd90b8c787ab85520622e90c73eb79d71ac82492e24277a2ffaa13c43e8c4190

0% xml 373 bytes contains

Filename fd90b8c7_app.manifest.bin File type xml MIME application/xml Size 373 SHA1 300879c71bf7ec4658769dd211390c95c86d7aa3

536ad85a299f5f7afc36f5944ea55d9f32495491265bf1305a41b3667176998d

0% zip 510251 bytes drops

Filename 536ad85a_zzzhu.zip.bin File type zip MIME application/zip Size 510251 SHA1 7aa157feed160f7e207ce961aaee21e3075b3ab9

2ca96e058f5f06ed9c587315e1bbafd70928f9503bebe952d874c157428c6f93

0% javascript 5811 bytes drops

Filename 2ca96e05_is-9vg48.tmp.bin File type javascript MIME application/javascript Size 5811 SHA1 b2cdc4f1a60abe206ee8f336aa0fbf85b5319e9b

b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793

0% text 19 bytes drops

Filename b16e1576_s1.json.bin File type text MIME text/plain Size 19 SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34

Related IPs

Network IPs associated with this indicator.

5shown

91.239.200.81

0% communicates

CIDR 91.239.200.0/22 Network 91.239.200.0-91.239.203.255 Country Czechia First seen 2026-04-27T20:41:03Z Last seen 2026-11-09T17:49:40Z

172.67.143.14

5% low US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-01T06:08:54Z Last seen 2026-11-14T17:01:42Z

104.21.79.93

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T06:34:50Z Last seen 2026-11-14T17:01:42Z

194.195.208.62

5% low US communicates

CIDR 194.195.208.0/20 Network 194.195.208.0-194.195.223.255 First seen 2023-12-20T18:21:54Z Last seen 2026-11-15T07:55:36Z

52.123.250.164

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-30T16:21:18Z Last seen 2026-11-15T15:17:24Z

Related domains

Domains associated with this indicator.

5shown

yaksamedia.com

11% high .com communicates

Root yaksamedia.com TLD com First seen 2026-07-08T03:17:15Z Last seen 2026-11-09T17:49:41Z

www.yaksamedia.com

6% medium .com communicates

Root yaksamedia.com TLD com Subdomain www First seen 2026-07-08T04:53:44Z Last seen 2026-11-09T17:49:41Z

www.bzdildetailing.cz

16% medium .cz communicates

Root bzdildetailing.cz TLD cz Subdomain www First seen 2026-07-08T15:27:28Z Last seen 2026-11-09T17:49:41Z

bzdildetailing.cz

21% medium .cz communicates

Root bzdildetailing.cz TLD cz First seen 2026-07-08T15:27:28Z Last seen 2026-11-09T17:49:41Z

atm.teams.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.teams.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-15T15:26:33Z

Related URLs

URLs associated with this indicator.

5shown

http://www.bzdildetailing.cz/fr77/?…

20% medium communicates

TLD cz HTTP status 404 Content length 614638 Content SHA256 10f4c5de651be66dc4aae2e6d7590f70678d3546c7fb9ec37ec2e24c7e3ccac8 First seen 2026-11-09T15:15:02Z

http://www.yaksamedia.com/uyhm/

10% high communicates

TLD com HTTP status 200 Content length 2939 Content SHA256 f641847535cbb33980cd7d1e6415dd93a40037a2c935d6e1058b6fe6166ad6e9 First seen 2026-10-24T23:34:14Z

http://www.yaksamedia.com/uyhm/?…

15% high communicates

TLD com HTTP status 200 Content length 2939 Content SHA256 f641847535cbb33980cd7d1e6415dd93a40037a2c935d6e1058b6fe6166ad6e9 First seen 2026-11-09T15:15:02Z

http://www.bzdildetailing.cz/fr77/

15% medium communicates

TLD cz HTTP status 404 Content length 614232 Content SHA256 a638d7633e9edf541b465232788e500e5b06cb3e2083155d2762b77b66def726 First seen 2026-10-25T09:37:16Z

http://www.sqlite.org/2021/sqlite-dll-win32-x86-3350000.zip

0% communicates

TLD org HTTP status 200 Content length 510251 Content SHA256 536ad85a299f5f7afc36f5944ea55d9f32495491265bf1305a41b3667176998d First seen 2022-08-30T17:09:57Z

Analysis details

Severity: criticaltrojanpolymorphicdotnetexedebug-checkobfuscatedexecutiondiscoverystealerpersistenceformbookdefense-evasion

Freshness: Fresh · Last seen 5 days ago.

Detection rate: 65%
Threat type: trojan
Family: msil
Confidence: 100%
detection: 65 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 2ec0a17c0b8dafa0cb5748d0ebf0162c5cb058b259d5b70e204723d9d73a463c
SHA1: 93adeef529b363e997dd0ff1870d7b93e69de2b8
MD5: bfb7ad141717e2dfe2b1cfc055c6f323
Filename: 2ec0a17c_ovtzfyxz.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1617920
Compile time: 2048-07-21T17:05:59Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T19F756C8337A6CA31EC68037281E693C8A376B911CC835F973259777D1C932A67DE25D8
SSDEEP: 24576:J1FZao2QWAYL78fuYu4Y+nWFy6aOZ/5JoSiHdR+:/7GIfu/JFyfOVoX9R
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2026-11-09T12:03:04Z
Last seen: 2026-11-09T17:49:35Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 65%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family msil.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2012-07-07 to 2048-07-21. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 65%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification msil

Classification context: type trojan, family msil.

Intelligence freshness Fresh

Last seen 5 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 2ec0a17c_ovtzfyxz.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 1617920
Compile time: 2048-07-21T17:05:59Z
PE platform: x86 32-bit
Entry point: 1623134
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkobfuscated

View details · 5 shown

.NET source code contains long base64-encoded strings
.NET source code contains potential unpacker
.NET source code contains very large array initializations
A DLL was loaded from a suspicious directory
Allocates memory with a write watch (potentially for evading sandboxes)

5 shown

View MITRE ATT&CK details · 5 shown

T1027 — .NET source code contains long base64-encoded strings
Tactics: TA0005
T1027.002 — .NET source code contains potential unpacker
Tactics: TA0005
T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

C0053.001 — Base64
Objectives: OC0004
Communication
Objectives: OC0006
Defense Evasion
Objectives: OB0006
C0002 — HTTP Communication
Objectives: OC0006
F0005 — Hidden Files and Directories
Objectives: OB0006 · OB0012

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 80

5+ outbound connections observed
3 domains, 3 IPs, 5 URLs
Common ports: 80
Protocols: HTTP, TCP

View details · 5 shown

Domain: www.yaksamedia.com
URL: http://www.yaksamedia.com/uyhm/?fvs=lgodrbyiuwi0c8hoa/babrwtdnu8vbkni0uzvahj5he+efuiyvfujgopbl53wbekzz9cy3bz69v+rhp/quexv0nbrajvzvsqpmtccdnnqmr16ggu643t+fs8jdyl2oj8gyfkxtg=&wf=dx-xzht0orc4wjcp
Protocol: HTTP

Domain: www.bzdildetailing.cz
URL: http://www.bzdildetailing.cz/fr77/?fvs=pmpyqt+hqowaq8rgykpt2+0ujrjrm8et/u18/qw3nh4gnl2bt5sxkjk/wlayp+vckivbfmonzjdc2madphy55kinc+nv+8lib5cwjqwo1v59k5zvygl5itv7kwd6bezmdlpgfby=&wf=dx-xzht0orc4wjcp
Protocol: HTTP

Domain: www.bzdildetailing.cz
URL: http://www.bzdildetailing.cz/fr77/
Protocol: HTTP

Domain: www.yaksamedia.com
URL: http://www.yaksamedia.com/uyhm/
Protocol: HTTP

IP: 194.195.208.62
Port: 80
Protocol: TCP

5 shown

DNS request activity4

A5+ response IPs

4 DNS requests observed
4 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 4 shown

Query: www.bzdildetailing.cz
Type: A
Answers: 91.239.200.81
Response: NOERROR

Query: www.yaksamedia.com
Type: A
Answers: 172.67.143.14, 104.21.79.93
Response: NOERROR

Query: www.sqlite.org
Type: A
Answers: 194.195.208.62
Response: NOERROR

Query: atm.teams.mira.tm.svc.cloud.microsoft
Type: A
Answers: 52.123.250.176, 52.123.250.175, 52.123.250.158, 52.123.250.135, 52.123.250.157, 52.123.250.154, 52.123.250.151, 52.123.250.164
Response: NOERROR

C2 candidates3

HTTP, DNSports 53

3 C2 candidate communications
2 domains, 1 IPs
Common ports: 53
Protocols: HTTP, DNS

View details · 3 shown

Domain: www.bzdildetailing.cz
Protocol: HTTP

Domain: www.yaksamedia.com
Protocol: HTTP

IP: 91.239.200.81
Domain: www.bzdildetailing.cz
Port: 53
Protocol: DNS

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2048-07-21T17:05:59Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 1623134
Sections: 3
Compile time: 2048-07-21T17:05:59Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 1614948
Raw size: 1615360
Permissions: rx
Entropy: 6.77

Name: .rsrc
Virtual address: 1630208
Virtual size: 1145
Raw size: 1536
Permissions: r
Entropy: 3.38

Name: .reloc
Virtual address: 1638400
Virtual size: 12
Raw size: 512
Permissions: r
Entropy: 0.1

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Resources2

2 resources

2 resources
Resource types: RT_MANIFEST, RT_VERSION

View details · 2 shown

Type: RT_VERSION
Language: NEUTRAL

Type: RT_MANIFEST
Language: NEUTRAL

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check