- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
30161f3b7d0ce2c86522cec3a4e97ea2b2a8065eddddfda258d80606da3af449- SHA1
418cd33cb59a5d46af7e9b29c2451fecea1fd414- MD5
15bff04d1b12e6e5a41a2518c6263858- Filename
- 30161f3b_payload.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 56320
- Compile time
- 2026-11-10T18:07:27Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 83%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections83%
VirusSign confidence100%
Relationship context7 visible
Threat classificationmsil
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
pedll
120832 bytes
drops
Filename
a8bd79d5_jg9e2mnn0.dll.bin
Type
malware
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
120832
0%
text
2151 bytes
drops
Filename
81ea3cf3_$r3a0pi8.cpx.bin
File type
text
MIME
text/plain
Size
2151
SHA1
a040d440ed71ad8f699ff6b92be0b55c4d56dcb6
0%
pedll
441856 bytes
drops
Filename
92fb0638_pnv9a5gi1.dll.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
441856
Compile time
2028-12-10T15:58:37Z
0%
pedll
286208 bytes
drops
Filename
db7fd195_d47gy4fjv.dll.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
286208
Compile time
2057-12-31T12:43:06Z
0%
pedll
86528 bytes
drops
Filename
ee10cd82_mzc1vl0v2.dll.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
86528
Compile time
1989-02-08T19:42:28Z
Related IPs
Network IPs associated with this indicator.
1shown
6%
low
CN
communicates
CIDR
8.162.0.0/17
Network
8.160.0.0-8.191.255.255
First seen
2026-04-22T14:06:41Z
Last seen
2026-11-14T11:31:30Z
Related domains
Domains associated with this indicator.
1shown
29%
high
.top
communicates
Root
cpolar.top
TLD
top
Subdomain
17.tcp
First seen
2023-12-13T05:58:33Z
Last seen
2026-11-14T11:31:31Z
Analysis details
Severity: hightrojanexedotnetself-deletepersistenceobfuscatedcryptowmi-activitymalwarenjratbladabindiexecution
Freshness: Fresh · Last seen 1 day ago.
- Detection rate
- 83%
- Threat type
- trojan
- Family
- msil
- Confidence
- 100%
- detection
- 83 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
30161f3b7d0ce2c86522cec3a4e97ea2b2a8065eddddfda258d80606da3af449- SHA1
418cd33cb59a5d46af7e9b29c2451fecea1fd414- MD5
15bff04d1b12e6e5a41a2518c6263858- Filename
- 30161f3b_payload.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 56320
- Compile time
- 2026-11-10T18:07:27Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 1
- TLSH
T16B432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE6- SSDEEP
1536:DkpMDnE4uNRty4X96ShDVwsNMDKXExI3pmfm:GMDnlYk4XNhDVwsNMDKXExI3pm- Imphash
f34d5f2d4577ed6d9ceec516c1f5a744- First seen
- 2026-11-11T17:06:26Z
- Last seen
- 2026-11-13T11:50:57Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 83%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family msil.
Relationship context
7 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
8 timestamped observations are arranged from 1989-02-08 to 2094-09-13. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family msil.
Last seen 1 day ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 30161f3b_payload.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 56320
- Compile time
- 2026-11-10T18:07:27Z
- PE platform
- x86 32-bit
- Entry point
- 61966
- Sections
- 3
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A file with an unusual extension was attempted to be loaded as a DLL.
- A process created a hidden window
- Accessed credential storage registry keys
- Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1564.003 — A process created a hidden windowTactics: TA0005
- T1003 — Accessed credential storage registry keysTactics: TA0006
- T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven executionTactics: TA0004 · TA0005
- T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patchingTactics: TA0004 · TA0005
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- E1010 — Application Window DiscoveryObjectives: OB0007
- C0026.001 · C0053.001 — Base64Objectives: OC0004
- F0013 — BootkitObjectives: OB0006 · OB0012
- E1510 — Clipboard ModificationObjectives: OB0008
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity2
TCPports 10856
- 2 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 10856
- Protocols: TCP
View details · 2 shown
- IP
- 8.162.11.200
- Port
- 10856
- Protocol
- TCP
- IP
- 8.162.11.200
- Port
- 10856
DNS request activity1
A1 response IPs
- 1 DNS requests observed
- 1 unique queries
- 1 response IPs
- Query types: A
- Response codes: NOERROR
View details · 1 shown
- Query
- 17.tcp.cpolar.top
- Type
- A
- Answers
- 8.162.11.200
- Response
- NOERROR
C2 candidates1
DNSports 53
- 1 C2 candidate communications
- 1 domains, 1 IPs
- Common ports: 53
- Protocols: DNS
View details · 1 shown
- IP
- 8.162.11.200
- Domain
- 17.tcp.cpolar.top
- Port
- 53
- Protocol
- DNS
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2026-11-10T18:07:27Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 61966
- Sections
- 3
- Compile time
- 2026-11-10T18:07:27Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: r, rx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 8192
- Virtual size
- 53780
- Raw size
- 54272
- Permissions
- rx
- Entropy
- 5.63
- Name
- .rsrc
- Virtual address
- 65536
- Virtual size
- 576
- Raw size
- 1024
- Permissions
- r
- Entropy
- 4.96
- Name
- .reloc
- Virtual address
- 73728
- Virtual size
- 12
- Raw size
- 512
- Permissions
- r
- Entropy
- 0.08
Imports1
1 DLL groups
- 1 import DLL groups
- 1 imported functions summarized
View details · 1 shown
- Library
- mscoree.dll
- Functions
- _CorExeMain
Resources1
1 resources
- 1 resources
- Resource types: RT_MANIFEST
View details · 1 shown
- Type
- RT_MANIFEST
- Language
- NEUTRAL