- First seen
- Last seen
THREAT SIGNALLow
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
46f8fb6c23edec5e5032914d131638b169b76ce69bd17c60508a72fec065e235- SHA1
f51fc1438edc09bfa4e2e4c6be280307483e6a59- MD5
23ca67a3f15d045b706e4e4f324b7966- Filename
- 46f8fb6c_is-1dgae.tmp.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 157112
- Compile time
- 2023-05-24T07:41:40Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Analysis signals
OBSERVEDEngine detections4%
VirusSign confidence40%
Relationship context13 visible
Threat classificationtrojan
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
5%
medium
peexe
103270019 bytes
drops
Filename
a24f13a1_installrentalgames.exe.bin
Type
pua
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
103270019
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
pedll
8704 bytes
drops
Filename
2fdf1f96_is-in3mq.tmp.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
8704
Compile time
2094-10-22T18:39:36Z
0%
pedll
711952 bytes
drops
Filename
e1e27af7_fileid_newtonsoft_json_dll_1649szlz.bin
Type
malware
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
711952
0%
pedll
582288 bytes
drops
Filename
1f2452ee_gii7f.exe.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
582288
Compile time
2073-11-03T05:59:21Z
0%
pedll
468992 bytes
drops
Filename
c0dd3a22_is-rv0q5.tmp.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
468992
Compile time
2023-01-06T21:45:00Z
0%
pedll
1412608 bytes
drops
Filename
d8ca446a__eeef0a9d449f443fb02d43c2c50b1774.3904a6fadbf8490ab8e74cb90db15431.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
1412608
Compile time
2023-01-06T21:45:00Z
Related IPs
Network IPs associated with this indicator.
5shown
0%
RU
communicates
CIDR
87.249.49.0/24
First seen
2025-03-06T06:11:31Z
Last seen
2025-12-08T21:46:04Z
11%
high
US
communicates
CIDR
209.197.0.0/19
Network
209.197.0.0-209.197.31.255
First seen
2023-09-30T21:27:37Z
Last seen
2026-11-14T17:19:43Z
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2023-09-29T22:00:59Z
Last seen
2026-11-14T17:19:43Z
0%
US
communicates
CIDR
20.64.0.0/10
Network
20.33.0.0-20.128.255.255
First seen
2023-09-29T18:30:08Z
Last seen
2026-11-14T17:47:59Z
0%
US
communicates
Network
192.229.128.0-192.229.255.255
First seen
2023-09-28T19:16:46Z
Last seen
2026-11-14T17:47:59Z
Related domains
Domains associated with this indicator.
2shown
0%
.in.ua
communicates
Root
rentalgames.in.ua
TLD
in.ua
First seen
2026-02-11T04:21:50Z
Last seen
2026-04-21T13:51:52Z
5%
low
.ru
communicates
Root
rentalgames.ru
TLD
ru
First seen
2026-09-27T17:58:33Z
Last seen
2026-10-12T16:56:23Z
Analysis details
Severity: hightrojanexedotnetfile-overlaydebug-checkexec-delayinput-checkinvalid-signaturesigned
Freshness: Aging · Last seen 36 days ago.
- Detection rate
- 4%
- Threat type
- trojan
- Confidence
- 40%
- detection
- 4 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
46f8fb6c23edec5e5032914d131638b169b76ce69bd17c60508a72fec065e235- SHA1
f51fc1438edc09bfa4e2e4c6be280307483e6a59- MD5
23ca67a3f15d045b706e4e4f324b7966- Filename
- 46f8fb6c_is-1dgae.tmp.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 157112
- Compile time
- 2023-05-24T07:41:40Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 1
- TLSH
T196E3D68C6FCBEC27D4DB2E34A503D3B015547EEE79AAB237936134897AE038894B1571- SSDEEP
1536:ooXUJ4TbHQD/dOzN+CgrY/sd2qNyEBzoYNgmt+NttAfK3dy3h2F:NkOTbwDlOzNHoY/sd7NyaXNgdtAC3dDF- Imphash
f34d5f2d4577ed6d9ceec516c1f5a744- First seen
- 2023-05-22T10:00:22Z
- Last seen
- 2026-10-09T05:14:20Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Relationship context
13 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
14 timestamped observations are arranged from 2023-01-06 to 2094-10-22. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan.
Last seen 36 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 46f8fb6c_is-1dgae.tmp.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 157112
- Compile time
- 2023-05-24T07:41:40Z
- PE platform
- x86 32-bit
- Entry point
- 30086
- Sections
- 3
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- .NET source code contains functionality to register a task
- .NET source code contains potential unpacker
- .NET source code contains very large strings
- Adds / modifies Windows certificates
- Binary contains a suspicious time stamp
5 shown
View MITRE ATT&CK details · 5 shown
- T1053 — .NET source code contains functionality to register a taskTactics: TA0002 · TA0003 · TA0004
- T1027.002 — .NET source code contains potential unpackerTactics: TA0005
- T1562.001 — Adds / modifies Windows certificatesTactics: TA0005
- T1070.006 — Binary contains a suspicious time stampTactics: TA0005
- T1497 — Contains long sleeps (>= 3 min)Tactics: TA0005 · TA0007
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5
TCPports 443, 80
- 5 outbound connections observed
- 0 domains, 5 IPs, 0 URLs
- Common ports: 443, 80
- Protocols: TCP
View details · 5 shown
- IP
- 209.197.3.8
- IP
- 87.249.49.236
- IP
- 23.216.147.64
- Port
- 443
- Protocol
- TCP
- IP
- 20.99.186.246
- Port
- 443
- Protocol
- TCP
- IP
- 192.229.211.108
- Port
- 80
- Protocol
- TCP
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2023-05-24T07:41:40Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 30086
- Sections
- 3
- Compile time
- 2023-05-24T07:41:40Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: r, rx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 8192
- Virtual size
- 21900
- Raw size
- 22016
- Permissions
- rx
- Entropy
- 5.73
- Name
- .rsrc
- Virtual address
- 32768
- Virtual size
- 128612
- Raw size
- 129024
- Permissions
- r
- Entropy
- 5.65
- Name
- .reloc
- Virtual address
- 163840
- Virtual size
- 12
- Raw size
- 512
- Permissions
- r
- Entropy
- 0.08
Imports1
1 DLL groups
- 1 import DLL groups
- 1 imported functions summarized
View details · 1 shown
- Library
- mscoree.dll
- Functions
- _CorExeMain
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION
View details · 4 shown
- Type
- RT_ICON
- Language
- NEUTRAL
- Type
- RT_GROUP_ICON
- Language
- NEUTRAL
- Type
- RT_VERSION
- Language
- NEUTRAL
- Type
- RT_MANIFEST
- Language
- NEUTRAL
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates3
3 issuers
- Example subject: RentalGames sing 2022-2023
- Issued by: RentalGames sing 2022-2023
- Validity period (UTC): 2022-05-27 – 2023-05-27
View details · 3 shown
- Subject
- RentalGames sing 2022-2023
- Issuer
- RentalGames sing 2022-2023
- Valid from
- 1653680520.0
- Valid to
- 1685217720.0
- Fingerprint
- F4A391EF95C6A4620C2763BB2366D18F61137474
- Subject
- Symantec SHA256 TimeStamping CA
- Issuer
- VeriSign Universal Root Certification Authority
- Fingerprint
- 6FC9EDB5E00AB64151C1CDFCAC74AD2C7B7E3BE4
- Subject
- Symantec SHA256 TimeStamping Signer - G3
- Issuer
- Symantec SHA256 TimeStamping CA
- Fingerprint
- A9A4121063D71D48E8529A4681DE803E3E7954B0