- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
67483a89ffbe3c9fd87b141f74c4db118e5ef18b8d85daa4e60970b80a7cdbd5- SHA1
9f0f2fc0a6c3670a8d661429080f9d7f633fe1ad- MD5
9bd4bf8a7733d3de866c7ea10f643693- Filename
- Invoice RK25.037-11-26 IPA.doc
- File type
- doc
- MIME
- application/octet-stream
- File size
- 951808
- Filename variants
- 2 reported
- TLSH
T19415E0343DEA401EF273EF755AD4B5AA9D2FBE633706944A2041334A4A32E81DED163D- SSDEEP
24576:v488T14FahDtY/PUVGb3eJflOYnXRZKv8KTpinjU+9:38T14FahDYTeJVKvtTcj
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 40%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections40%
VirusSign confidence100%
Relationship context16 visible
Threat classificationsdrop
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
text
46 bytes
drops
Filename
3903daac9bc4a3b7.timestamp
File type
text
MIME
text/plain
Size
46
SHA1
818ae4ef4b820eca8070dc0b82c06683ca1d17a9
0%
lnk
1131 bytes
drops
Filename
Invoice RK25.037-11-26 IPA.doc.LNK
File type
lnk
MIME
application/x-ms-shortcut
Size
1131
SHA1
5ce5e8ac95faf3b677d516425d2a32aafedd71fd
15%
high
vba
3095 bytes
contains
Filename
ThisDocument.cls
Family
bp1ke71dolm
Type
dropper
File type
vba
MIME
text/plain
0%
zip
966946 bytes
drops
Filename
Lainaus.thmx
File type
zip
MIME
application/zip
Size
966946
SHA1
a6e021918c3ceffb6490222d37eceed1fc435d52
0%
4096 bytes
contains
Filename
[5]DocumentSummaryInformation
MIME
application/octet-stream
Size
4096
SHA1
3b67fb3a7e80a7d3f9fac27179fd5f2a8579e768
First seen
2017-03-25T11:16:01Z
Related IPs
Network IPs associated with this indicator.
5shown
6%
medium
CA
communicates
CIDR
209.127.32.0/20
Network
209.127.0.0-209.127.48.255
First seen
2025-12-11T05:46:49Z
Last seen
2026-11-08T19:00:59Z
0%
US
communicates
CIDR
52.96.0.0/12
Network
52.96.0.0-52.115.255.255
First seen
2023-10-07T21:15:42Z
Last seen
2026-11-10T00:46:45Z
0%
US
communicates
CIDR
52.96.0.0/12
Network
52.96.0.0-52.115.255.255
First seen
2023-10-04T09:05:13Z
Last seen
2026-11-10T03:00:59Z
US
communicates
CIDR
52.96.0.0/12
Network
52.96.0.0-52.115.255.255
First seen
2023-10-01T18:01:54Z
Last seen
2026-11-10T00:05:43Z
5%
low
US
communicates
CIDR
208.95.112.0/22
Network
208.95.112.0-208.95.115.255
First seen
2023-09-30T15:26:15Z
Last seen
2026-11-10T05:02:01Z
Related domains
Domains associated with this indicator.
4shown
0%
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
svc
First seen
2023-11-09T10:19:11Z
Last seen
2026-11-10T05:02:16Z
0%
.com
communicates
Root
live.com
TLD
com
Subdomain
nexus.officeapps
First seen
2023-09-30T17:48:59Z
Last seen
2026-11-10T03:13:13Z
5%
low
.com
communicates
Root
ip-api.com
TLD
com
First seen
2023-09-30T15:26:15Z
Last seen
2026-11-10T05:02:01Z
5%
low
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
roaming.svc
First seen
2024-08-26T16:41:58Z
Last seen
2026-11-10T05:02:16Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
TLD
microsoft
HTTP status
400
Content SHA256
855bb50e73e6b2d1c6d6d69ee436c9dfcc5b390a49d50119f8f2eea677bcaefd
First seen
2025-08-22T00:53:09Z
Last seen
2026-11-10T05:02:16Z
5%
low
communicates
TLD
com
HTTP status
200
Content length
293
Content SHA256
0fbf7512a030085b0e374a55a7a7a600ae2027dc32455349111fb9e95a5d1039
First seen
2014-02-12T22:16:52Z
Analysis details
Severity: hightrojanfile-accessauto-actionsadapter-discoveryexecfile-writeole-createfile-createobfuscateddocpersistencecrypto
Freshness: Fresh · Last seen 1 day ago.
- Detection rate
- 40%
- Threat type
- trojan
- Family
- sdrop
- Confidence
- 100%
- detection
- 40 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
67483a89ffbe3c9fd87b141f74c4db118e5ef18b8d85daa4e60970b80a7cdbd5- SHA1
9f0f2fc0a6c3670a8d661429080f9d7f633fe1ad- MD5
9bd4bf8a7733d3de866c7ea10f643693- Filename
- Invoice RK25.037-11-26 IPA.doc
- File type
- doc
- MIME
- application/octet-stream
- File size
- 951808
- TLSH
T19415E0343DEA401EF273EF755AD4B5AA9D2FBE633706944A2041334A4A32E81DED163D- SSDEEP
24576:v488T14FahDtY/PUVGb3eJflOYnXRZKv8KTpinjU+9:38T14FahDYTeJVKvtTcj- First seen
- 2026-11-08T14:28:32Z
- Last seen
- 2026-11-08T19:00:36Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 40%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family sdrop.
Relationship context
16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
17 timestamped observations are arranged from 2014-01-24 to 2026-11-08. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family sdrop.
Last seen 1 day ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- Invoice RK25.037-11-26 IPA.doc
- File type
- doc
- MIME
- application/octet-stream
- Size
- 951808
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A document file initiated network communications indicative of a potential exploit or payload download
- A document or script file initiated network communications indicative of a potential exploit or payload download
- A file with an unusual extension was attempted to be loaded as a DLL.
- A ping command was executed with the -n argument possibly to delay analysis
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1071 · T1221 — A document file initiated network communications indicative of a potential exploit or payload downloadTactics: TA0005 · TA0011
- T1071 — A ping command was executed with the -n argument possibly to delay analysisTactics: TA0011
- T1564.003 — A process created a hidden windowTactics: TA0005
- T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven executionTactics: TA0004 · TA0005
5 shown
View MBC details · 5 shown
- B0030 — C2 CommunicationObjectives: OB0004
- Command and ControlObjectives: OB0004
- E1059 — Command and Scripting InterpreterObjectives: OB0009
- CommunicationObjectives: OC0006
- E1486 — Data Encrypted for ImpactObjectives: OB0008
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 443, 5000, 80
- 5+ outbound connections observed
- 2 domains, 3 IPs, 2 URLs
- Common ports: 443, 5000, 80
- Protocols: HTTP, TCP
View details · 5 shown
- IP
- 209.127.35.214
- Port
- 5000
- Protocol
- TCP
- Domain
- roaming.svc.cloud.microsoft
- URL
- https://roaming.svc.cloud.microsoft/rs/roamingsoapservice.svc
- Protocol
- HTTP
- Domain
- ip-api.com
- URL
- http://ip-api.com/json/
- Protocol
- HTTP
- IP
- 208.95.112.1
- Port
- 80
- Protocol
- TCP
- IP
- 52.110.6.13
- Port
- 443
- Protocol
- TCP
DNS request activity2
A4 response IPs
- 2 DNS requests observed
- 2 unique queries
- 4 response IPs
- Query types: A
- Response codes: NOERROR
View details · 2 shown
- Query
- roaming.svc.cloud.microsoft
- Type
- A
- Answers
- 52.110.6.25, 52.110.6.27, 52.110.6.13
- Response
- NOERROR
- Query
- ip-api.com
- Type
- A
- Answers
- 208.95.112.1
- Response
- NOERROR
C2 candidates1
TCPports 5000
- 1 C2 candidate communications
- 0 domains, 1 IPs
- Common ports: 5000
- Protocols: TCP
View details · 1 shown
- IP
- 209.127.35.214
- Port
- 5000
- Protocol
- TCP