- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
3eef4b88ac1c5825c5ec314b366e390e64941b8e944fa9abdfc426498be22d66- SHA1
4254fde89b27c7200d7a67f67e24ba09d91e7dee- MD5
40a65a855d23320682fdaae993480c76- Filename
- 3eef4b88_d0ypre2.vcf.bin
- File type
- html
- MIME
- text/html
- File size
- 68252
- SSDEEP
1536:HwzAbky54I3bWYZ6uLbcfXCUkTFGEiarVmS67QHwiAEFyEe1nsJScFNql9wLH1qx:QzAbkymIbvcfXCLkarV6UHwi9g1nsSeM- First seen
- 2013-06-08T00:08:57Z
- Last seen
- 2025-07-31T10:34:04Z
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (12%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections12%
VirusSign confidence76%
Relationship context15 visible
Threat classificationfaceliker
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related IPs
Network IPs associated with this indicator.
5shown
5%
low
US
communicates
CIDR
92.38.144.0/23
Network
92.38.145.0-92.38.145.255
First seen
2023-09-30T15:48:58Z
Last seen
2026-11-15T04:33:14Z
0%
US
communicates
CIDR
23.2.80.0/20
Network
23.0.0.0-23.15.255.255
First seen
2023-10-12T08:30:18Z
Last seen
2026-11-15T04:33:45Z
5%
low
US
communicates
CIDR
199.232.0.0/16
Network
199.232.0.0-199.232.255.255
First seen
2024-03-23T12:33:32Z
Last seen
2026-11-15T04:34:09Z
0%
US
communicates
CIDR
150.171.0.0/19
Network
150.171.0.0-150.171.255.255
First seen
2025-06-21T19:05:03Z
Last seen
2026-11-15T04:32:19Z
0%
US
communicates
CIDR
151.101.0.0/16
Network
151.101.0.0-151.101.255.255
First seen
2023-09-30T05:49:19Z
Last seen
2026-11-15T04:22:07Z
Related domains
Domains associated with this indicator.
5shown
0%
.net
communicates
Root
ln-msedge.net
TLD
net
Subdomain
ln-0007
First seen
2025-07-24T03:39:28Z
Last seen
2026-11-15T04:32:19Z
0%
.net
communicates
Root
ln-msedge.net
TLD
net
Subdomain
config-edge-skype.ln-0007
First seen
2025-07-25T02:30:00Z
Last seen
2026-11-15T04:32:19Z
0%
.net
communicates
Root
fbcdn.net
TLD
net
Subdomain
scontent.xx
First seen
2023-09-29T20:54:37Z
Last seen
2026-11-15T02:32:54Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
c
First seen
2023-09-29T22:23:03Z
Last seen
2026-11-15T04:33:42Z
0%
.com
communicates
Root
google-analytics.com
TLD
com
Subdomain
www
First seen
2023-09-29T17:44:34Z
Last seen
2026-11-15T04:26:48Z
Related URLs
URLs associated with this indicator.
5shown
0%
communicates
TLD
com
HTTP status
200
Content length
17208
Content SHA256
fcf226c2b59242c58b437e44d9b2ab53636f147c9438d8ac21d841d46589600c
First seen
2025-07-21T12:09:04Z
0%
communicates
TLD
com
HTTP status
200
Content length
3638
Content SHA256
a1495da3cf3db37bf105a12658636ff628fee7b73975b9200049af7747e60b1f
First seen
2025-07-21T12:09:04Z
0%
communicates
TLD
com
HTTP status
200
Content length
23190
Content SHA256
970f551b691c910dee4ca146197d8f5d5feaf78a7dadb873600fecb2fb009527
First seen
2025-07-22T05:53:09Z
0%
communicates
TLD
com
HTTP status
200
Content SHA256
e171f2248d50064f27d51c0ce46cab138c0a1119958a7362e8c46214f371b440
First seen
2014-06-12T07:56:31Z
Last seen
2026-02-03T12:54:41Z
0%
communicates
TLD
com
HTTP status
200
Content length
28403
Content SHA256
7f8a0b475770c8282980d5c50a5a092ca8f9838a4c5d9c79d7ae0c66bf936afc
First seen
2025-07-21T12:09:04Z
Analysis details
Severity: hightrojanhtmldiscoverydownloader
Freshness: Historical · Last seen 471 days ago.
- Detection rate
- 12%
- Threat type
- trojan
- Family
- faceliker
- Confidence
- 76%
- detection
- 12 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
3eef4b88ac1c5825c5ec314b366e390e64941b8e944fa9abdfc426498be22d66- SHA1
4254fde89b27c7200d7a67f67e24ba09d91e7dee- MD5
40a65a855d23320682fdaae993480c76- Filename
- 3eef4b88_d0ypre2.vcf.bin
- File type
- html
- MIME
- text/html
- File size
- 68252
- SSDEEP
1536:HwzAbky54I3bWYZ6uLbcfXCUkTFGEiarVmS67QHwiAEFyEe1nsJScFNql9wLH1qx:QzAbkymIbvcfXCLkarV6UHwi9g1nsSeM- First seen
- 2013-06-08T00:08:57Z
- Last seen
- 2025-07-31T10:34:04Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (12%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type trojan and family faceliker.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2013-06-08 to 2025-07-25. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family faceliker.
Last seen 471 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 3eef4b88_d0ypre2.vcf.bin
- File type
- html
- MIME
- text/html
- Size
- 68252
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP
- 5+ outbound connections observed
- 5+ domains, 0 IPs, 5+ URLs
- Protocols: HTTP
View details · 5 shown
- Domain
- x1.c.lencr.org
- URL
- http://x1.c.lencr.org/
- Protocol
- HTTP
- Domain
- www.linkwithin.com
- URL
- http://www.linkwithin.com/widget.js
- Protocol
- HTTP
- Domain
- www.linkwithin.com
- URL
- http://www.linkwithin.com/pixel.png
- Protocol
- HTTP
- Domain
- www.gothamknightsonline.com
- URL
- http://www.gothamknightsonline.com/js/jquery-ui-personalized-1.5.2.packed.js
- Protocol
- HTTP
- Domain
- www.google-analytics.com
- URL
- http://www.google-analytics.com/ga.js
- Protocol
- HTTP
5 shown