- First seen
- Last seen
THREAT SIGNALLow
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
5884a96926c7c1fd0371ab0c32aa3531342380a5c4582f457988700d3384435e- SHA1
15ccd71a82b3f4a89f25b5fe3d9ce9f972b52788- MD5
a95c1680fc4ec7850628fd649e528ea0- Filename
- 5884a969_obfuscathon.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 21504
- Compile time
- 2008-11-10T09:40:34Z
- PE platform
- x86 32-bit
- PE sections
- 4
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Analysis signals
OBSERVEDEngine detections4%
Relationship context7 visible
Threat classificationtrojan
Intelligence freshnessHistorical
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
2shown
5%
high
zip
4165990 bytes
contains
Filename
6be397bc_mcp25(1).zip.bin
Type
trojan
File type
zip
MIME
application/zip
Size
4165990
5%
high
zip
4193419 bytes
contains
Filename
0c8763a5_mcp25.zip.bin
Type
trojan
File type
zip
MIME
application/zip
Size
4193419
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
python
2997 bytes
drops
File type
python
MIME
text/x-python
Size
2997
SHA1
bcdaeade16795c2254bf9ae031453c05ff51c4f5
First seen
2024-04-23T05:56:05Z
0%
javascript
10 bytes
contains
Filename
7e0f0247_2f4993d1d40570248faf2cc846027eef.bin
File type
javascript
MIME
application/javascript
Size
10
SHA1
74db835d52d97a16a7c90b7e75c5a530cce41ec8
0%
8704 bytes
contains
Filename
d3c24986_.text.bin
MIME
application/octet-stream
Size
8704
SHA1
681c8d8703f243f75d87b4d907c8d00cf2d02828
First seen
2017-12-14T12:48:27Z
0%
2560 bytes
contains
Filename
3ab04c9e_.rdata.bin
MIME
application/octet-stream
Size
2560
SHA1
cd34cf98d2355f97ccbd60e6290549cd68bd5819
First seen
2017-12-07T20:37:53Z
0%
3072 bytes
contains
Filename
7fe6d290_mjukmtmu.bin
MIME
application/octet-stream
Size
3072
SHA1
d7bf9b095493ab8e9678d229191f0d9674a9ef9f
First seen
2017-12-08T16:19:46Z
Analysis details
Severity: hightrojanexe
Freshness: Historical · Last seen 310 days ago.
- Detection rate
- 4%
- Threat type
- trojan
- detection
- 4 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
5884a96926c7c1fd0371ab0c32aa3531342380a5c4582f457988700d3384435e- SHA1
15ccd71a82b3f4a89f25b5fe3d9ce9f972b52788- MD5
a95c1680fc4ec7850628fd649e528ea0- Filename
- 5884a969_obfuscathon.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 21504
- Compile time
- 2008-11-10T09:40:34Z
- PE platform
- x86 32-bit
- PE sections
- 4
- Import libraries
- 2
- TLSH
T1EAA25CC77B64467AE8F40474A532902F5933B3B3779A53D3AA50AD3B19D82D0CC3AB49- SSDEEP
384:2An2vPeqUfmEZ+nUn0fJCfMdXWgugoL2RE902mFs/fVCHwX:2ZPeqYmEb0kUXS90pFsfVCM- Imphash
b28c641d753fb51b62a00fe6115070ae- Richhash
1816eb5ea280a37bfbf0737173799a75- First seen
- 2010-12-27T17:25:33Z
- Last seen
- 2026-01-08T04:29:26Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Relationship context
7 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
8 timestamped observations are arranged from 2008-11-10 to 2024-04-23. These are observation or metadata times, not execution order.
Intelligence freshness
Last seen 310 days ago. Revalidate volatile infrastructure before enforcement.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan.
Last seen 310 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 5884a969_obfuscathon.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 21504
- Compile time
- 2008-11-10T09:40:34Z
- PE platform
- x86 32-bit
- Entry point
- 11048
- Sections
- 4
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit4 sections
- Platform: x86 32-bit
- Sections: 4
- Entry point: present
- Compile time: 2008-11-10T09:40:34Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 11048
- Sections
- 4
- Compile time
- 2008-11-10T09:40:34Z
PE sections4
4 sections
- 4 PE sections
- Common permissions: r, rw, rx
- 4 unique section names
View details · 4 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 8324
- Raw size
- 8704
- Permissions
- rx
- Entropy
- 6.09
- Name
- .rdata
- Virtual address
- 16384
- Virtual size
- 2322
- Raw size
- 2560
- Permissions
- r
- Entropy
- 4.71
- Name
- .data
- Virtual address
- 20480
- Virtual size
- 5736
- Raw size
- 3072
- Permissions
- rw
- Entropy
- 4.53
- Name
- .rsrc
- Virtual address
- 28672
- Virtual size
- 6136
- Raw size
- 6144
- Permissions
- r
- Entropy
- 5.0
Imports2
2 DLL groups
- 2 import DLL groups
- 5+ imported functions summarized
View details · 2 shown
- Library
- MSVCR90.dll
- Functions
- ?terminate@@YAXXZ, __dllonexit, __getmainargs, __initenv, __iob_func, __p__commode, __p__fmode, __set_app_type …
- Library
- KERNEL32.dll
- Functions
- CloseHandle, CreateFileA, CreateFileMappingA, FindResourceA, FormatMessageA, FreeLibrary, GetCurrentProcess, GetCurrentProcessId …
Resources2
2 resources
- 2 resources
- Resource types: PYTHONSCRIPT, RT_MANIFEST
View details · 2 shown
- Type
- PYTHONSCRIPT
- Language
- NEUTRAL
- Type
- RT_MANIFEST
- Language
- NEUTRAL