Report - 37d9912ec552…04e5ce7ae1

No detections FILE

Quota 30

First seen: 2026-09-05T08:32:41Z
Last seen: 2026-10-23T02:58:28Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS20Connections in this report

ANALYSISNo detectionsRecent

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: 37d9912ec552321c0855d4d27e8ec4000eb808b4e852f6d978cddd04e5ce7ae1
SHA1: e569a3e19ed4074497788491839aa5175b480ae5
MD5: 3cc6097dd2d9248e638f0ca4f9bc7157
Filename: 37d9912e_braveupdatesetup.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 131307872
Compile time: 2026-09-03T14:55:53Z
PE platform: x86 32-bit
PE sections: 5

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context20 visible

Intelligence freshnessRecent

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

ef6a6be145eb8463750b37befbf26c8322b2388ae39e9a4dd6a29a5dcb6bca30

0% pedll 42064 bytes drops

Filename ef6a6be1_bqxoy.exe.bin File type pedll MIME application/vnd.microsoft.portable-executable Size 42064 Compile time 2026-09-03T14:29:29Z

d954d78130e2495729640953ea763f2a10f6ac9cf77502ef0c1527fc20c22887

0% pedll 45136 bytes drops

Filename d954d781_4gpgyoj.exe.bin File type pedll MIME application/vnd.microsoft.portable-executable Size 45136 Compile time 2026-09-03T14:29:29Z

d7743431011e04268b742e71c8900530eacb7ecc564454b6083bf8234b298fbb

0% peexe 106064 bytes drops

Filename d7743431_3orcwi.exe.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 106064 Compile time 2026-09-03T14:36:36Z

d58214c1d0509b6402aabf5df3c0141a2f3e3386b304e2d2e95d22e4e39dd633

0% pedll 1091152 bytes drops

Filename d58214c1_1xmux.exe.bin File type pedll MIME application/vnd.microsoft.portable-executable Size 1091152 Compile time 2026-09-03T14:33:42Z

c613d66586310886b497b5a6d034206622ee9409310cf52ab274be4677a53372

0% pedll 43088 bytes drops

Filename c613d665_goopdateres_am.dll.bin File type pedll MIME application/vnd.microsoft.portable-executable Size 43088 Compile time 2026-09-03T14:29:28Z

Related IPs

Network IPs associated with this indicator.

5shown

3.165.160.27

0% US communicates

CIDR 3.128.0.0/10 Network 3.165.0.0-3.165.255.255 First seen 2024-08-31T02:14:30Z Last seen 2026-11-13T08:14:45Z

3.162.112.66

0% US communicates

CIDR 3.128.0.0/10 Network 3.160.0.0-3.163.255.255 First seen 2023-09-30T19:37:41Z Last seen 2026-11-13T23:08:30Z

3.162.112.64

0% US communicates

CIDR 3.128.0.0/10 Network 3.160.0.0-3.163.255.255 First seen 2023-09-30T05:35:46Z Last seen 2026-11-13T23:08:30Z

3.162.112.48

0% US communicates

CIDR 3.128.0.0/10 Network 3.160.0.0-3.163.255.255 First seen 2023-09-29T16:24:06Z Last seen 2026-11-13T23:08:30Z

3.162.112.30

0% US communicates

CIDR 3.128.0.0/10 Network 3.160.0.0-3.163.255.255 First seen 2023-10-03T01:50:37Z Last seen 2026-11-13T23:08:30Z

Related domains

Domains associated with this indicator.

5shown

d1fakx6bn3adcj.cloudfront.net

0% .net communicates

Root cloudfront.net TLD net Subdomain d1fakx6bn3adcj First seen 2024-11-07T17:01:57Z Last seen 2026-11-13T23:08:30Z

s.ss2.us

0% .us communicates

Root ss2.us TLD us Subdomain s First seen 2023-09-30T03:24:07Z Last seen 2026-11-15T04:26:48Z

variations.brave.com

0% .com communicates

Root brave.com TLD com Subdomain variations First seen 2023-10-01T10:31:38Z Last seen 2026-11-14T08:11:49Z

updates.bravesoftware.com

0% .com communicates

Root bravesoftware.com TLD com Subdomain updates First seen 2018-06-17T18:31:50Z Last seen 2026-11-14T07:55:50Z

redirector.brave.com

0% .com communicates

Root brave.com TLD com Subdomain redirector First seen 2023-09-30T02:41:14Z Last seen 2026-11-14T00:34:26Z

Related URLs

URLs associated with this indicator.

5shown

https://dl.brave.com/update2/installers/icons/%7B50474E96-9CD2-4BC8-B0…

0% communicates

TLD com HTTP status 404 First seen 2026-09-26T18:35:48Z Last seen 2026-10-23T02:59:16Z

http://ocsp.r2m01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM…

0% communicates

TLD com HTTP status 200 Content length 471 Content SHA256 ee09383d3837e997e84cdb355e74408f08c63734f4e70f2bf067ae6d53753a31 First seen 2026-10-04T15:01:51Z

https://updates.bravesoftware.com/service/update2

0% communicates

TLD com HTTP status 405 First seen 2018-07-28T21:38:24Z Last seen 2026-11-12T01:38:20Z

http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8+5VZ5/a9jFT…

0% communicates

TLD com HTTP status 200 Content length 1438 Content SHA256 275a4cc1b2681cfd3c62e1c0b1f2b17278fd6e549fbd6d8ae4430a12326598ce First seen 2026-10-02T12:57:43Z

http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYn…

0% communicates

TLD com HTTP status 200 Content length 1560 Content SHA256 7bc6895e3fa4cf794fb20bd3e1ac37d52a29e666b2db744228fd0c92bd9853c0 First seen 2016-01-24T01:16:42Z

Analysis details

exefile-overlayself-deletesigned

Freshness: Recent · Last seen 23 days ago.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 37d9912ec552321c0855d4d27e8ec4000eb808b4e852f6d978cddd04e5ce7ae1
SHA1: e569a3e19ed4074497788491839aa5175b480ae5
MD5: 3cc6097dd2d9248e638f0ca4f9bc7157
Filename: 37d9912e_braveupdatesetup.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 131307872
Compile time: 2026-09-03T14:55:53Z
PE platform: x86 32-bit
PE sections: 5
Import libraries: 6
TLSH: T18B5833543884E425C5C42C3FFEF436D102ECDE3A56A2EE1F26A986B47586859F972F03
SSDEEP: 3145728:v2uuW6zKgEMr3/N8NNz/tGZjFb/R2GDmNdoWNBJlbWA9JatU:+u562+vWj7cZR78GD9E7bWOU
Imphash: 59dd7ae6bef680b839d5a65e314ee5ce
Richhash: 5e98d9aa1b0a9cc8386a07c429d84c9e
First seen: 2026-09-05T08:32:41Z
Last seen: 2026-10-23T02:58:28Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2016-01-24 to 2026-10-04. These are observation or metadata times, not execution order.

Infrastructure geography

5 infrastructure/location point(s) are visible on the map.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Recent

Last seen 23 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 37d9912e_braveupdatesetup.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 131307872
Compile time: 2026-09-03T14:55:53Z
PE platform: x86 32-bit
Entry point: 28452
Sections: 5

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

self-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
Binary contains paths to debug symbols
Checks system language via registry key (possible geofencing)
Classification label
Contains modern PE file flags such as dynamic base (ASLR) or NX

5 shown

View MITRE ATT&CK details · 4 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1070 — Deletes executed files from disk
Tactics: TA0005
T1082 — Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software
Tactics: TA0007
T1562.001 — Tries to unhook or modify Windows functions monitored by CAPE
Tactics: TA0005

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Communication
Objectives: OC0006
Defense Evasion
Objectives: OB0006
F0004 — Disable or Evade Security Tools
Objectives: OB0006
B0003 — Dynamic Analysis Evasion
Objectives: OB0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, HTTP, UDPports 443, 80, 53

5+ outbound connections observed
5+ domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 53, 5353
Protocols: TCP, HTTP, UDP

View details · 5 shown

IP: 8.8.8.8
Port: 53
Protocol: UDP

Domain: updates.bravesoftware.com
URL: https://updates.bravesoftware.com/service/update2
Protocol: HTTP

Domain: dl.brave.com
URL: https://dl.brave.com/update2/installers/icons/%7b50474e96-9cd2-4bc8-b0a7-0d4b6ef2e709%7d.bmp
Protocol: HTTP

Domain: ocsp.rootg2.amazontrust.com
URL: http://ocsp.rootg2.amazontrust.com/mfqwujbqme4wtdajbgurdgmcgguabbsifarexmfqfjr3tkmynd7o5mhzegqunf8a36ob1zaroiiiug1knpirkymcewz/leoqj83z+skukwh5co65xmy=
Protocol: HTTP

Domain: ocsp.rootg2.amazontrust.com
URL: http://ocsp.rootg2.amazontrust.com/mfqwujbqme4wtdajbgurdgmcgguabbsifarexmfqfjr3tkmynd7o5mhzegqunf8a36ob1zaroiiiug1knpirkymcewz%2fleoqj83z%2bskukwh5co65xmy%3d
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: cl-glcb907925.gcdn.co
Type: A
Answers: 92.223.96.6
Response: NOERROR

Query: variations.brave.com
Type: A
Answers: 3.165.160.27, 3.165.160.66, 3.165.160.65, 3.165.160.120
Response: NOERROR

Query: updates.bravesoftware.com
Type: A
Answers: 52.85.129.84, 52.85.129.73, 52.85.129.43, 52.85.129.125
Response: NOERROR

Query: updates.bravesoftware.com
Type: A
Answers: 3.162.112.48, 3.162.112.64, 3.162.112.66, 3.162.112.30
Response: NOERROR

Query: s.ss2.us

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5 sections

Platform: x86 32-bit
Sections: 5
Entry point: present
Compile time: 2026-09-03T14:55:53Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 28452
Sections: 5
Compile time: 2026-09-03T14:55:53Z

PE sections5

5 sections

5 PE sections
Common permissions: r, rw, rx
5 unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 105840
Raw size: 105984
Permissions: rx
Entropy: 6.64

Name: .rdata
Virtual address: 110592
Virtual size: 34510
Raw size: 34816
Permissions: r
Entropy: 5.03

Name: .data
Virtual address: 147456
Virtual size: 5292
Raw size: 2560
Permissions: rw
Entropy: 2.4

Name: .rsrc
Virtual address: 155648
Virtual size: 131138360
Raw size: 131138560
Permissions: r
Entropy: 8.0

Name: .reloc
Virtual address: 131297280
Virtual size: 5428
Raw size: 5632
Permissions: r
Entropy: 6.49

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: AcquireSRWLockExclusive, CloseHandle, CopyFileW, CreateDirectoryW, CreateFileMappingW, CreateFileW, CreateProcessW, DecodePointer …

Library: SHLWAPI.dll
Functions: PathAppendW, PathCanonicalizeW, PathQuoteSpacesW, PathRemoveExtensionW, PathStripPathW

Library: ADVAPI32.dll
Functions: RegCloseKey, RegCreateKeyExW, RegSetValueExW

Library: ole32.dll
Functions: CoInitializeEx, CoUninitialize

Library: SHELL32.dll
Functions: Ord(680), SHGetFolderPathW

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_ICON, B, BRAVEUPDATE, RT_GROUP_ICON

View details · 5 shown

Type: B
Language: NEUTRAL

Type: BRAVEUPDATE
Language: NEUTRAL

Type: RT_ICON
Language: ENGLISH US

Type: RT_STRING
Language: ARABIC SAUDI ARABIA

Type: RT_STRING
Language: BULGARIAN DEFAULT

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5 issuers

Example subject: Brave Software, Inc.
Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Validity period (UTC): 2024-05-28 – 2027-08-06

View details · 5 shown

Subject: Brave Software, Inc.
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Valid from: 1716854400.0
Valid to: 1817596740.0
Fingerprint: F8AC5F11DE7E26383B7A389FC19A2613835799D7

Subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issuer: DigiCert Trusted Root G4
Valid from: 1619654400.0
Valid to: 2093039940.0
Fingerprint: 7B0F360B775F76C94A12CA48445AA2D2A875701C

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Valid from: 1659312000.0
Valid to: 1952035140.0
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert
Issuer: DigiCert Assured ID Root CA
Valid from: 1163116800.0
Valid to: 1952035200.0
Fingerprint: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check