Report - 491a68206038…b57cae3d3b

No detections FILE

Quota 36

First seen: 2026-03-27T20:41:35Z
Last seen: 2026-11-12T11:49:31Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS8Connections in this report

ANALYSISNo detectionsFresh

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: 491a68206038a66c97e5e98094923cc0e7529504e506c13d6996c2b57cae3d3b
SHA1: 710b2438fd71e50569e12af4a0bba3e2d38b8dad
MD5: 4be2b1c8948f2d8e479b859ea027fd86
Filename: 491a6820_fil_7231704157.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 1373392
Compile time: 2075-12-06T10:41:51Z
PE platform: x64 64-bit
PE sections: 8

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

8 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context8 visible

Intelligence freshnessFresh

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

8 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

8d5299b5c910e9293b355cb79ed31b796238cfd99d0dff1166b99611561eb50d

52% high peexe 3376584 bytes contains

Filename 8d5299b5_9ee5f624e3ac.exe.bin Family penguish Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

5ebc7c29731b9916a7596c8bf4d67472e63cddf163b71fa4c8f6017f4a5cc839

26% high zip 14751133 bytes contains

Filename 5ebc7c29_tmp-38262-daa1zhuzwd5q.zip.bin Family rugmi Type trojan File type zip MIME application/zip

23e55185416ec6456e8492b51aea5e9e2d0cf699861454e2b998107dcfa1daab

48% high zip 5341256 bytes drops

Filename 23e55185_sorgo.zip.bin Family rugmi Type trojan File type zip MIME application/zip

f12c4b34906b35b4d1e3ac6cdf3e0a4c75f4e7bdb89cbbf669e0b3502917f680

4% high zip 33638331 bytes drops

Filename f12c4b34_download.zip.bin Type trojan File type zip MIME application/zip Size 33638331

d5ad0d0d1de0b59d18d1aeb32fd5591e8fffda623600f48516cca02f8cb3b854

5% high zip 11059111 bytes drops

Filename d5ad0d0d_com_srv_svc_v7_rc.zip.bin Type trojan File type zip MIME application/zip Size 11059111

Dropped / child files

Files dropped, bundled, or created by the queried file.

1shown

ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7

0% 4096 bytes contains

Filename ad7facb2_.idata.bin MIME application/octet-stream Size 4096 SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d First seen 2007-02-23T01:34:31Z

Related IPs

Network IPs associated with this indicator.

1shown

92.223.96.6

5% high US communicates

CIDR 92.223.96.0/22 Network 92.223.92.0-92.223.102.255 First seen 2025-10-16T01:11:08Z Last seen 2026-11-15T07:49:45Z

Related domains

Domains associated with this indicator.

1shown

cl-glcb907925.gcdn.co

5% low .co communicates

Root gcdn.co TLD co Subdomain cl-glcb907925 First seen 2025-07-06T03:15:52Z Last seen 2026-11-15T07:49:45Z

Analysis details

64bitfile-overlaydebug-checkdllobfuscatedsigned

Freshness: Fresh · Last seen 2 days ago.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 491a68206038a66c97e5e98094923cc0e7529504e506c13d6996c2b57cae3d3b
SHA1: 710b2438fd71e50569e12af4a0bba3e2d38b8dad
MD5: 4be2b1c8948f2d8e479b859ea027fd86
Filename: 491a6820_fil_7231704157.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 1373392
Compile time: 2075-12-06T10:41:51Z
PE platform: x64 64-bit
PE sections: 8
Import libraries: 29
TLSH: T1AA55AE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
SSDEEP: 24576:QM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszW75mxvSZX0ypOpTq1:QM622DUVOb+uiMfE+nzTv2ApvzHWpI
Imphash: 00abed89ba5e6cf95f5c70be53069caa
Richhash: e2f541557025b3aef095a2d45242e6fc
First seen: 2026-03-27T20:41:35Z
Last seen: 2026-11-12T11:49:31Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

8 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

9 timestamped observations are arranged from 2007-02-23 to 2075-12-06. These are observation or metadata times, not execution order.

Infrastructure geography

1 infrastructure/location point(s) are visible on the map.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 8 visible

4 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Fresh

Last seen 2 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 491a6820_fil_7231704157.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
Size: 1373392
Compile time: 2075-12-06T10:41:51Z
PE platform: x64 64-bit
Entry point: 408448
Sections: 8

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkobfuscated

View details · 5 shown

At least one IP Address, Domain, or File Name was found in a crypto call
Binary compilation timestomping detected
Binary contains a suspicious time stamp
Binary contains paths to debug symbols
Checks available memory

5 shown

View MITRE ATT&CK details · 5 shown

T1070.006 — Binary compilation timestomping detected
Tactics: TA0005
T1082 — Checks available memory
Tactics: TA0007
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007
T1057 — Enumerates the modules from a process (may be used to locate base addresses in process injection)
Tactics: TA0007
T1562.001 — Launches processes in debugging mode, may be used to hinder debugging
Tactics: TA0005

5 shown

View MBC details · 5 shown

C0007 — Allocate Memory
Objectives: OC0002
Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0032.020 — Argument Obfuscation
Objectives: OB0002
B0009.005 — Check Registry Keys
Objectives: OB0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

DNS request activity1

A1 response IPs

1 DNS requests observed
1 unique queries
1 response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: cl-glcb907925.gcdn.co
Type: A
Answers: 92.223.96.6
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2075-12-06T10:41:51Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 408448
Sections: 8
Compile time: 2075-12-06T10:41:51Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 1007417
Raw size: 1007616
Permissions: rx
Entropy: 6.54

Name: fothk
Virtual address: 1011712
Virtual size: 4096
Raw size: 4096
Permissions: rx
Entropy: 0.19

Name: .rdata
Virtual address: 1015808
Virtual size: 257840
Raw size: 258048
Permissions: r
Entropy: 5.99

Name: .data
Virtual address: 1273856
Virtual size: 9764
Raw size: 8192
Permissions: rw
Entropy: 1.26

Name: .pdata
Virtual address: 1286144
Virtual size: 55092
Raw size: 57344
Permissions: r
Entropy: 5.95

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: api-ms-win-core-errorhandling-l1-1-0.dll
Functions: GetLastError, RaiseException, SetErrorMode, SetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter

Library: api-ms-win-core-heap-l1-1-0.dll
Functions: GetProcessHeap, HeapAlloc, HeapCompact, HeapFree, HeapQueryInformation, HeapReAlloc, HeapSize, HeapValidate …

Library: api-ms-win-core-processthreads-l1-1-0.dll
Functions: CreateProcessW, CreateThread, ExitProcess, ExitThread, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId …

Library: api-ms-win-core-libraryloader-l1-1-0.dll
Functions: FreeLibrary, FreeLibraryAndExitThread, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetProcAddress, LoadLibraryExW

Library: api-ms-win-core-sysinfo-l1-2-0.dll
Functions: VerSetConditionMask

5 shown

Exports5+

5+ exported items

5+ exported items

View details · 5 shown

Name: _Cbuild

Name: _Cmulcc

Name: _Cmulcr

Name: _CreateFrameInfo

Name: _CxxThrowException

5 shown

Resources1

1 resources

1 resources
Resource types: RT_VERSION

View details · 1 shown

Type: RT_VERSION
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

3 issuers

Example subject: Microsoft Windows
Issued by: Microsoft Windows Production PCA 2011
Validity period (UTC): 2025-11-13 – 2026-10-18

View details · 5 shown

Subject: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011
Valid from: 1763062440.0
Valid to: 1792352040.0
Fingerprint: 3EE4E719F74DDA999C1081F17F0F05EDA6A5FF4D

Subject: Microsoft Windows Production PCA 2011
Issuer: Microsoft Root Certificate Authority 2010
Valid from: 1319049660.0
Valid to: 1792435860.0
Fingerprint: 580A6F4CC4E4B669B9EBDC1B2B3E087B80D0678D

Subject: Microsoft Root Certificate Authority 2010
Issuer: Microsoft Root Certificate Authority 2010
Valid from: 1277330220.0
Valid to: 2066249040.0
Fingerprint: 3B1EFD3A66EA28B16697394703A72CA340A05BD5

Subject: Microsoft Time-Stamp Service
Issuer: Microsoft Time-Stamp PCA 2010
Fingerprint: D91CAC5F5F7A4572D3C00FCFF111567544E952C6

Subject: Microsoft Time-Stamp PCA 2010
Issuer: Microsoft Root Certificate Authority 2010
Fingerprint: 36056A5662DCADECF82CC14C8B80EC5E0BCC59A6

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check