- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
5dc372a10f345b1f00ec6a8fa1a2ce569f7e5d63e4f1f8631be367e46bfa34f4- SHA1
5475cb28998d419b4714343ffa9511ff46322ac2- MD5
970b6e6478ae3ab699f277d77de0cd19- Filename
- _92CADEE49D164AFCB17D56260C1AE1CE
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 26752
- Compile time
- 2060-06-07T14:52:20Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
5 related indicators are shown across 1 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context5 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
4%
high
peexe
157112 bytes
drops
Filename
is-1DGAE.tmp
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
157112
4%
low
pedll
3941816 bytes
drops
Filename
cd147bc72be1d1830d35a56b180b587d.virus
File type
pedll
MIME
application/vnd.microsoft.portable-executable
Size
3941816
Compile time
2021-12-02T22:02:03Z
4%
low
peexe
3347963 bytes
drops
Filename
MIDIControl_2.0.3_Setup.exe
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
3347963
Compile time
2023-02-15T14:54:16Z
38%
high
peexe
4802146 bytes
drops
Filename
TEC ZAPP.exe
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
4802146
4%
medium
peexe
9940933 bytes
drops
Filename
MuloBinary5Gold -20.04.2023.exe
Type
riskware
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
9940933
Analysis details
legitdlldebug-checkinput-checkdotnetfile-overlayknownsrcdynamic-loadingsigned
Freshness: Fresh · Last seen today.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
5dc372a10f345b1f00ec6a8fa1a2ce569f7e5d63e4f1f8631be367e46bfa34f4- SHA1
5475cb28998d419b4714343ffa9511ff46322ac2- MD5
970b6e6478ae3ab699f277d77de0cd19- Filename
- _92CADEE49D164AFCB17D56260C1AE1CE
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 26752
- Compile time
- 2060-06-07T14:52:20Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 1
- TLSH
T1C6C26D16E35C5317CFBA2EF5E570D6432A35E78A2C12E72E1148E2A51C97384AB31739- SSDEEP
768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ- Imphash
dae02f32a21e03ce65412f6e56942daa- First seen
- 2022-11-09T21:35:14Z
- Last seen
- 2026-11-12T18:10:50Z
- Filename variants
- 5 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
5 related indicators are shown across 1 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
6 timestamped observations are arranged from 1992-06-19 to 2060-06-07. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
1 relationship group(s) provide pivot and infrastructure context.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- _92CADEE49D164AFCB17D56260C1AE1CE
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 26752
- Compile time
- 2060-06-07T14:52:20Z
- PE platform
- x86 32-bit
- Entry point
- 21490
- Sections
- 3
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Binary contains a suspicious time stamp
- Binary contains paths to debug symbols
- Classification label
- Contains medium sleeps (>= 30s)
- Contains modern PE file flags such as dynamic base (ASLR) or NX
5 shown
View MITRE ATT&CK details · 5 shown
- T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.Tactics: TA0011
- T1070.006 — Binary contains a suspicious time stampTactics: TA0005
- T1497 — Contains medium sleeps (>= 30s)Tactics: TA0005 · TA0007
- T1056 — Creates a DirectInput object (often for capturing keystrokes)Tactics: TA0006 · TA0009
- T1082 — Reads software policiesTactics: TA0007
5 shown
View MBC details · 2 shown
- CommunicationObjectives: OC0006
- C0002 — HTTP CommunicationObjectives: OC0006
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2060-06-07T14:52:20Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 21490
- Sections
- 3
- Compile time
- 2060-06-07T14:52:20Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: r, rx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 8192
- Virtual size
- 13304
- Raw size
- 13312
- Permissions
- rx
- Entropy
- 5.92
- Name
- .rsrc
- Virtual address
- 24576
- Virtual size
- 1808
- Raw size
- 2048
- Permissions
- r
- Entropy
- 3.17
- Name
- .reloc
- Virtual address
- 32768
- Virtual size
- 12
- Raw size
- 512
- Permissions
- r
- Entropy
- 0.08
Imports1
1 DLL groups
- 1 import DLL groups
- 1 imported functions summarized
View details · 1 shown
- Library
- mscoree.dll
- Functions
- _CorDllMain
Resources1
1 resources
- 1 resources
- Resource types: RT_VERSION
View details · 1 shown
- Type
- RT_VERSION
- Language
- NEUTRAL
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5
4 issuers
- Example subject: .NET
- Issued by: Microsoft Code Signing PCA 2011
- Validity period (UTC): 2022-08-04 – 2023-08-03
View details · 5 shown
- Subject
- .NET
- Issuer
- Microsoft Code Signing PCA 2011
- Valid from
- 1659644580.0
- Valid to
- 1691094180.0
- Fingerprint
- BAD82E2EF44BB92439512D19CE762B1410E68654
- Subject
- Microsoft Code Signing PCA 2011
- Issuer
- Microsoft Root Certificate Authority 2011
- Valid from
- 1310158740.0
- Valid to
- 1783544940.0
- Fingerprint
- F252E794FE438E35ACE6E53762C0A234A2C52135
- Subject
- Microsoft Root Certificate Authority 2011
- Issuer
- Microsoft Root Certificate Authority 2011
- Valid from
- 1300831500.0
- Valid to
- 2089836780.0
- Fingerprint
- 8F43288AD272F3103B6FB1428485EA3014C0BCFE
- Subject
- Microsoft Time-Stamp Service
- Issuer
- Microsoft Time-Stamp PCA 2010
- Fingerprint
- B3C970DB45B39B10CA88DD4B861EE66565EEB4A8
- Subject
- Microsoft Time-Stamp PCA 2010
- Issuer
- Microsoft Root Certificate Authority 2010
- Fingerprint
- 36056A5662DCADECF82CC14C8B80EC5E0BCC59A6