- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
533f3d51caf21ae4ebc672527d917f2d81c0faba862a7a736df3b19fd41b78e4- SHA1
2c777c2bdc61ab195ea6957944c5fc24d2b1870f- MD5
953f0da6844bdae4d3190b3c1e6bc1b0- Filename
- 533f3d51_acc80cwp.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 425004606
- TLSH
T1B8193306F99061E6D609B436B280E745A125B3525B87EC3AF78C4726F3C64C3FBB174A- SSDEEP
12582912:9Q8+oCDlHVu6gmGTnUxZGNlQLxaVZGZcoUhSHlYIfbfXT9:6foCDlHRgmmUXGNmx4ZGZ7UhSH3F
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Threat context
Classification includes type pua.
Analysis signals
OBSERVEDEngine detections6%
Relationship context10 visible
Threat classificationpua
Intelligence freshnessAging
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
msi
82592256 bytes
drops
Filename
43a327c7_60505f.msi.bin
File type
msi
MIME
application/x-msi
Size
82592256
SHA1
d3d34105f8e5fa9b136bfbe0324acc7ce02d2fee
0%
text
13416 bytes
drops
Filename
62c3a486__3ab4ff58_329c_4b86_b50d_9d7142835c90.bin
File type
text
MIME
text/plain
Size
13416
SHA1
f8b4d24fd6235bc6e01d7beb0934f8985d95d564
0%
javascript
857 bytes
drops
Filename
c1981be2__fd1ab36b11668298964d629f9469a8d2.bin
File type
javascript
MIME
application/javascript
Size
857
SHA1
d603f194cba5912d7ae06e8fe1ac0a9e09dcc55c
6%
medium
msi
164773888 bytes
contains
Filename
e84fd02f_609b33.msi.bin
Type
pua
File type
msi
MIME
application/x-msi
Size
164773888
0%
pedll
110136 bytes
drops
Filename
16c4cf37_difxapp.bin
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
110136
Compile time
2008-08-23T02:19:00Z
Related IPs
Network IPs associated with this indicator.
2shown
0%
US
communicates
CIDR
172.64.144.0/20
Network
172.64.0.0-172.71.255.255
First seen
2026-07-10T14:10:54Z
Last seen
2026-07-24T20:52:38Z
0%
US
communicates
CIDR
104.16.0.0/14
Network
104.16.0.0-104.31.255.255
First seen
2026-07-30T12:42:49Z
Last seen
2026-07-30T12:42:49Z
Related domains
Domains associated with this indicator.
2shown
0%
.com
communicates
Root
identrust.com
TLD
com
Subdomain
validation
First seen
2023-09-29T19:56:23Z
Last seen
2026-11-10T15:01:57Z
0%
.com
communicates
Root
identrust.com
TLD
com
First seen
2023-10-01T13:00:11Z
Last seen
2026-11-14T11:38:06Z
Related URLs
URLs associated with this indicator.
1shown
0%
communicates
TLD
com
HTTP status
200
Content length
3383
Content SHA256
96007b95b2a5edd0002645396c24cdef5b093b69e0837f9fb87bbb9bbfc4e34e
First seen
2024-01-30T08:45:56Z
Analysis details
Severity: mediumpuaembedded-executablezipprocess-renamedebug-checkusb-checkexec-delayinput-check
Freshness: Aging · Last seen 87 days ago.
- Detection rate
- 6%
- Threat type
- pua
- detection
- 6 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
533f3d51caf21ae4ebc672527d917f2d81c0faba862a7a736df3b19fd41b78e4- SHA1
2c777c2bdc61ab195ea6957944c5fc24d2b1870f- MD5
953f0da6844bdae4d3190b3c1e6bc1b0- Filename
- 533f3d51_acc80cwp.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 425004606
- TLSH
T1B8193306F99061E6D609B436B280E745A125B3525B87EC3AF78C4726F3C64C3FBB174A- SSDEEP
12582912:9Q8+oCDlHVu6gmGTnUxZGNlQLxaVZGZcoUhSHlYIfbfXT9:6foCDlHRgmmUXGNmx4ZGZ7UhSH3F- First seen
- 2025-01-21T12:58:50Z
- Last seen
- 2026-08-20T06:37:09Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (6%).
Threat context
Classification includes type pua.
Relationship context
10 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
11 timestamped observations are arranged from 2008-08-23 to 2026-07-30. These are observation or metadata times, not execution order.
Infrastructure geography
2 infrastructure/location point(s) are visible on the map. 2 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type pua.
Last seen 87 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 533f3d51_acc80cwp.zip.bin
- File type
- zip
- MIME
- application/zip
- Size
- 425004606
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- AV process strings found (often used to terminate AV products)
- Adds / modifies Windows certificates
- Allocates memory with a write watch (potentially for evading sandboxes)
- Binary contains paths to development resources
- Bypasses PowerShell execution policy
5 shown
View MITRE ATT&CK details · 5 shown
- T1518.001 — AV process strings found (often used to terminate AV products)Tactics: TA0007
- T1562.001 — Adds / modifies Windows certificatesTactics: TA0005
- T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.Tactics: TA0011
- T1497 — Allocates memory with a write watch (potentially for evading sandboxes)Tactics: TA0005 · TA0007
- T1059.001 — Bypasses PowerShell execution policyTactics: TA0002
5 shown
View MBC details · 3 shown
- CommunicationObjectives: OC0006
- C0002 — HTTP CommunicationObjectives: OC0006
- C0005.001 — InternetConnectObjectives: OC0006
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity3
HTTP, TCPports 80
- 3 outbound connections observed
- 1 domains, 1 IPs, 1 URLs
- Common ports: 80
- Protocols: HTTP, TCP
View details · 2 shown
- Domain
- validation.identrust.com
- URL
- http://validation.identrust.com/certs/trustidevcodesigning4.p7c
- Protocol
- HTTP
- IP
- 104.18.32.224
- Port
- 80
- Protocol
- TCP
DNS request activity1
A2 response IPs
- 1 DNS requests observed
- 1 unique queries
- 2 response IPs
- Query types: A
- Response codes: NOERROR
View details · 1 shown
- Query
- validation.identrust.com
- Type
- A
- Answers
- 104.18.32.224, 172.64.155.32
- Response
- NOERROR