Report - 57d39f6ae5aa…3292e3aa76

No detections FILE

Quota 36

First seen: 2026-10-16T04:28:12Z
Last seen: 2026-11-11T00:30:10Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS21Connections in this report

ANALYSISNo detectionsFresh

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: 57d39f6ae5aa066af31504d4213213157ad2b6dda425dafc6fddd83292e3aa76
SHA1: be7c98004bc335f0188de40e0366d22f15607488
MD5: ffa38781697f60d72e5892bf5f0b0e6d
Filename: 57d39f6a_geek.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 4154000
Compile time: 2026-10-14T11:18:32Z
PE platform: x64 64-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

21 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context21 visible

Intelligence freshnessFresh

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

21 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

c6b8aa8dd08fbee1f67aa6d636402e4c11f373def0d69355acb594e348d6dfd1

74% high peexe 12058711 bytes drops

Filename c6b8aa8d_geek.exe.bin Family floxif Type dropper File type peexe MIME application/vnd.microsoft.portable-executable

5f442bc45e90c4481ec3a7380648a62a82a5c76ad5007095333bca242c8a3f7a

75% critical peexe 12058711 bytes drops

Filename 5f442bc4_geek.exe.bin Family floxif Type dropper File type peexe MIME application/vnd.microsoft.portable-executable

096b3254403a400f2adcfa8a35bb40a75bf6a3d2c45fc30918700a2d73364222

75% critical peexe 12058711 bytes drops

Filename 096b3254_geek.exe.bin Family floxif Type dropper File type peexe MIME application/vnd.microsoft.portable-executable

0959ccb4fcae13512ccba5f57317981926869766d55be881fbec1b7951e5e1ad

91% critical peexe 12742656 bytes drops

Filename 0959ccb4fcae13512ccba5f57317981926869766d55be881fbec1b7951e5e1ad Family darkkomet Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

b834e2cc449552cda6b355a8a525de18b0dfe99c0aa83f970510b041c076e344

33% high peexe 12731904 bytes drops

Filename b834e2cc_geek.exe.bin Family expiro Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

342ea84255d3bc59be5c5edad040c49b8ee46582fca4b2a430c9af23a9cfb0dd

0% ico 2238 bytes contains

Filename 342ea842_37.ico.bin File type ico MIME application/octet-stream Size 2238 SHA1 efda7cbc1f26e3d17b954d0337033e5b74356a15

1c2155ea92caaa134c567e5325b31cecfaee0ae5395884d2305a82a93bcfb552

0% 618 bytes contains

Filename 1c2155ea_9356.bin MIME application/octet-stream Size 618 SHA1 d4a7105b528ee3195adaff497b654c0a8d1270ec First seen 2013-02-26T21:37:29Z

68d542ed291df04d535fff19675f743ef4707dae55caea57c7a4e6df7f98368d

0% ico 1406 bytes contains

Filename 68d542ed_120.ico.bin File type ico MIME application/octet-stream Size 1406 SHA1 2ea12cae0eed64b032186f7f4e398d98c0c41182

7bb77d0be6dcfb91153af64d65de962803b63dc53f9ee1049505f23ec8c76dfe

0% ico 1758 bytes contains

Filename 7bb77d0b_53.ico.bin File type ico MIME application/octet-stream Size 1758 SHA1 69d3785ee5a9637227aede5b564092b19c0b6d05

10889476eddc528a08981b09069b1c391212cb1014d2dda9f9faf97872d1f5b1

0% 160 bytes contains

Filename 10889476_3316.bin MIME application/octet-stream Size 160 SHA1 7ded3628c9d0c0471029493fc7be7b62932e4640 First seen 2016-04-05T00:07:19Z

Related IPs

Network IPs associated with this indicator.

4shown

173.230.144.164

5% low US communicates

CIDR 173.230.128.0/19 Network 173.230.128.0-173.230.159.255 First seen 2023-09-30T08:12:46Z Last seen 2026-11-14T15:08:03Z

104.18.21.213

0% US communicates

CIDR 104.16.0.0/14 Network 104.16.0.0-104.31.255.255 First seen 2023-10-04T08:10:46Z Last seen 2026-11-14T17:06:44Z

104.18.20.213

0% US communicates

CIDR 104.16.0.0/14 Network 104.16.0.0-104.31.255.255 First seen 2023-10-08T00:53:38Z Last seen 2026-11-14T17:06:44Z

8.8.8.8

6% low US communicates

CIDR 8.8.8.0/24 Network 8.8.8.0-8.8.8.255 First seen 2023-09-29T05:20:58Z Last seen 2026-11-14T17:12:18Z

Related domains

Domains associated with this indicator.

5shown

yr.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr.c First seen 2025-11-04T11:49:44Z Last seen 2026-11-14T16:58:03Z

yr2.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr2.c First seen 2026-01-07T19:14:52Z Last seen 2026-11-14T15:01:18Z

geekuninstaller.com

0% .com communicates

Root geekuninstaller.com TLD com First seen 2023-03-12T07:28:08Z Last seen 2026-11-13T19:10:07Z

c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain c First seen 2023-09-29T22:23:03Z Last seen 2026-11-14T17:11:00Z

x1.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain x1.c First seen 2023-10-01T12:22:46Z Last seen 2026-11-14T17:11:10Z

Related URLs

URLs associated with this indicator.

2shown

http://yr2.c.lencr.org/41.crl

0% communicates

TLD org HTTP status 200 Content length 251934 Content SHA256 7e0756db9390a630dc5d3c7d5fce7bb09d3343133ce41f8458e9814bf001a5de First seen 2026-06-21T19:05:06Z

https://geekuninstaller.com/update.txt

0% communicates

TLD com HTTP status 200 Content length 71 Content SHA256 ad0a2327be6b5619e5559298b0180639ddcc62fd55d6ad8fe3fce41cfa46b7b7 First seen 2017-07-21T05:03:21Z

Analysis details

64bitexefile-overlayobfuscatedsigned

Freshness: Fresh · Last seen 3 days ago.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 57d39f6ae5aa066af31504d4213213157ad2b6dda425dafc6fddd83292e3aa76
SHA1: be7c98004bc335f0188de40e0366d22f15607488
MD5: ffa38781697f60d72e5892bf5f0b0e6d
Filename: 57d39f6a_geek.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 4154000
Compile time: 2026-10-14T11:18:32Z
PE platform: x64 64-bit
PE sections: 6
Import libraries: 19
TLSH: T163167C8672F801E8D1ABC17D89468A0BDAB1B8065B6197CF355C8B5A5F337D14E3F322
SSDEEP: 49152:MG/P8QI8MRg2pvyhE+V1fSJmDZvWpvJUOgLVVMi64yHA8pyIg00C2T:UaQRA00h
Imphash: a03668f44becc487f923b46d8d8c472d
Richhash: 4a55eaeaf76e45a330b61356b0c1405b
First seen: 2026-10-16T04:28:12Z
Last seen: 2026-11-11T00:30:10Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

21 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

22 timestamped observations are arranged from 1992-06-19 to 2026-10-14. These are observation or metadata times, not execution order.

Infrastructure geography

4 infrastructure/location point(s) are visible on the map. 2 point(s) are country-level approximate.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 21 visible

5 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Fresh

Last seen 3 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 57d39f6a_geek.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 4154000
Compile time: 2026-10-14T11:18:32Z
PE platform: x64 64-bit
Entry point: 2100036
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscated

View details · 5 shown

Authenticode signature is invalid
Binary contains paths to debug symbols
Classification label
Creates files inside the user directory
Creates mutexes

5 shown

View MITRE ATT&CK details · 5 shown

T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1036 — Creates files inside the user directory
Tactics: TA0005
T1553.002 — Presents an Authenticode digital signature
Tactics: TA0112
T1082 — Queries the cryptographic machine GUID
Tactics: TA0007
T1083 — Reads ini files
Tactics: TA0007

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Communication
Objectives: OC0006
B0002 — Debugger Evasion
Objectives: OB0001
Defense Evasion
Objectives: OB0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53, 80

5+ outbound connections observed
2 domains, 3 IPs, 2 URLs
Common ports: 443, 53, 80
Protocols: HTTP, TCP, UDP

View details · 5 shown

IP: 8.8.8.8
Port: 53
Protocol: UDP

IP: 173.230.144.164
Port: 443
Protocol: TCP

Domain: geekuninstaller.com
URL: https://geekuninstaller.com/update.txt
Protocol: HTTP

Domain: yr2.c.lencr.org
URL: http://yr2.c.lencr.org/41.crl
Protocol: HTTP

IP: 104.18.20.213
Port: 80
Protocol: TCP

DNS request activity4

A3 response IPs

4 DNS requests observed
4 unique queries
3 response IPs
Query types: A
Response codes: NOERROR

View details · 4 shown

Query: yr2.c.lencr.org
Type: A
Answers: 104.18.20.213, 104.18.21.213
Response: NOERROR

Query: yr.c.lencr.org

Query: x1.c.lencr.org

Query: geekuninstaller.com
Type: A
Answers: 173.230.144.164
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-10-14T11:18:32Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 2100036
Sections: 6
Compile time: 2026-10-14T11:18:32Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 2443459
Raw size: 2443776
Permissions: rx
Entropy: 6.4

Name: .rdata
Virtual address: 2449408
Virtual size: 862824
Raw size: 863232
Permissions: r
Entropy: 5.44

Name: .data
Virtual address: 3313664
Virtual size: 93108
Raw size: 58880
Permissions: rw
Entropy: 4.42

Name: .pdata
Virtual address: 3407872
Virtual size: 132132
Raw size: 132608
Permissions: r
Entropy: 6.23

Name: .fptable
Virtual address: 3543040
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: AcquireSRWLockExclusive, ActivateActCtx, CloseHandle, CompareFileTime, CompareStringEx, CompareStringW, CreateActCtxW, CreateDirectoryW …

Library: USER32.dll
Functions: AdjustWindowRectEx, AppendMenuW, BeginDeferWindowPos, BeginPaint, BringWindowToTop, CallNextHookEx, CallWindowProcW, CharLowerBuffA …

Library: GDI32.dll
Functions: BeginPath, BitBlt, CloseFigure, CombineRgn, CreateBitmap, CreateCompatibleBitmap, CreateCompatibleDC, CreateDCW …

Library: MSIMG32.dll
Functions: GradientFill

Library: WINSPOOL.DRV
Functions: ClosePrinter, DocumentPropertiesW, OpenPrinterW

5 shown

Resources5+

5+ resources

5+ resources
Resource types: XML, RT_ICON, RT_CURSOR, RT_BITMAP, PNG

View details · 5 shown

Type: PNG
Language: NEUTRAL

Type: XML
Language: NEUTRAL

Type: RT_CURSOR
Language: NEUTRAL

Type: RT_BITMAP
Language: NEUTRAL

Type: RT_ICON
Language: NEUTRAL

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5+ issuers

Example subject: CrystalBit Solutions
Issued by: Sectigo Public Code Signing CA R36
Validity period (UTC): 2026-02-13 – 2029-04-13

View details · 5 shown

Subject: CrystalBit Solutions
Issuer: Sectigo Public Code Signing CA R36
Valid from: 1770940800.0
Valid to: 1870819140.0
Fingerprint: D2160F2D80588DB473734D2176DD185A5106C0CF

Subject: Sectigo Public Code Signing CA R36
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2089756740.0
Fingerprint: 0BC5E76773D2E44FC9903D4DFEFE451553BBEC4A

Subject: Sectigo Public Code Signing Root R46
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2405289540.0
Fingerprint: CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D

Subject: Sectigo Public Code Signing Root R46
Issuer: AAA Certificate Services
Fingerprint: 329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692

Subject: Sectigo Public Time Stamping Root R46
Issuer: USERTrust RSA Certification Authority
Fingerprint: 853D632D938282617CD09035C491DE92C142DAC7

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check