- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
6bdaf9b5ddbb8a1520e79c931e816acd7dbc0b59156dfa29366c66ee72e695e0- SHA1
c0f1c7eb6b1f9e23e0d8c52908bd1322e22d360c- MD5
576f438f168e7502dfe5d3ab86336440- Filename
- 6bdaf9b5_11.2.0.2 client win32.iso.bin
- File type
- isoimage
- MIME
- application/x-iso9660-image
- File size
- 644872192
- TLSH
T1C0693326C9C10D6EE09353B312236A219A2EF593D2C6C85772EC1B859B91FC91F57CCB- SSDEEP
12582912:V77BjZlc6qIxidQkzPXl9Wboj2MGjRRmeuMMFzog:57BNhiQYXz3j2PRRVuMazo
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context17 visible
Intelligence freshnessRecent
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
ttf
344908 bytes
drops
Filename
0faaaca3_lucidabrightregular.ttf.bin
File type
ttf
MIME
font/ttf
Size
344908
SHA1
5d7ed564791c900a8786936930ba99385653139c
0%
text
3376 bytes
drops
Filename
f1dc97da_fil5bcb8076981bc7df2aad43fde4369335.bin
File type
text
MIME
text/plain
Size
3376
SHA1
2e9f9ac287274532eb1f0d1afcefd7f3e97cc794
0%
text
2856 bytes
drops
Filename
3d83e336_fil144ccd3868dac15607d878d6cc3853b5.bin
File type
text
MIME
text/plain
Size
2856
SHA1
c1e0f01408bf20fbbb8b4810520c725f70050db5
0%
text
1210 bytes
drops
Filename
299c2360_cwbvahuabgbkac4acabyag8acablahiadabpaguacwa=.bin
File type
text
MIME
text/plain
Size
1210
SHA1
9afceb218059d981d0fa9f07aad3c5097cf41b0c
0%
powershell
60 bytes
drops
Filename
96ad1146___psscriptpolicytest_iugzvutm.mi5.ps1.bin
File type
powershell
MIME
text/plain
Size
60
SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
8.246.0.0/15
First seen
2024-01-02T10:23:27Z
Last seen
2026-11-06T12:46:14Z
0%
US
communicates
CIDR
23.214.224.0/19
First seen
2023-08-27T22:18:21Z
Last seen
2026-11-11T17:01:14Z
0%
US
communicates
CIDR
108.177.0.0/17
Network
108.177.0.0-108.177.127.255
First seen
2023-09-29T22:00:59Z
Last seen
2026-11-14T09:48:28Z
0%
US
communicates
CIDR
108.177.96.0/19
Network
108.177.0.0-108.177.127.255
First seen
2023-09-29T05:20:58Z
Last seen
2026-11-14T11:10:22Z
0%
US
communicates
CIDR
172.217.128.0/17
Network
172.217.0.0-172.217.255.255
First seen
2026-07-08T20:42:24Z
Last seen
2026-11-14T11:10:22Z
Related domains
Domains associated with this indicator.
5shown
0%
.net
communicates
Root
fastly.net
TLD
net
Subdomain
fg.microsoft.map
First seen
2024-03-24T09:46:06Z
Last seen
2026-11-14T11:11:31Z
0%
.com
communicates
Root
microsoft.com
TLD
com
Subdomain
dmd.metaservices
First seen
2023-09-29T12:53:17Z
Last seen
2026-11-11T17:01:15Z
0%
.com
communicates
Root
microsoft.com
TLD
com
Subdomain
metaservices
First seen
2023-09-30T12:04:12Z
Last seen
2026-11-11T17:01:15Z
0%
.com
communicates
Root
microsoft.com
TLD
com
Subdomain
go
First seen
2023-09-28T21:48:38Z
Last seen
2026-11-14T07:48:04Z
0%
.com
communicates
Root
googleapis.com
TLD
com
Subdomain
update
First seen
2023-09-30T15:26:15Z
Last seen
2026-11-14T11:10:23Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
TLD
com
First seen
2019-11-01T16:41:39Z
Last seen
2026-11-11T17:01:15Z
0%
communicates
TLD
com
HTTP status
502
Content length
269
Content SHA256
99de7dadcb76c60806f7f5b1e8cb88b09cc360c85299e19f377cf0cee9a62954
First seen
2014-08-22T23:11:23Z
Analysis details
embedded-executableisoimagewmi-activitydebug-checkexec-delayinput-checkenv-checkpersistence
Freshness: Recent · Last seen 22 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
6bdaf9b5ddbb8a1520e79c931e816acd7dbc0b59156dfa29366c66ee72e695e0- SHA1
c0f1c7eb6b1f9e23e0d8c52908bd1322e22d360c- MD5
576f438f168e7502dfe5d3ab86336440- Filename
- 6bdaf9b5_11.2.0.2 client win32.iso.bin
- File type
- isoimage
- MIME
- application/x-iso9660-image
- File size
- 644872192
- TLSH
T1C0693326C9C10D6EE09353B312236A219A2EF593D2C6C85772EC1B859B91FC91F57CCB- SSDEEP
12582912:V77BjZlc6qIxidQkzPXl9Wboj2MGjRRmeuMMFzog:57BNhiQYXz3j2PRRVuMazo- First seen
- 2023-08-22T17:22:06Z
- Last seen
- 2026-10-23T05:01:22Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
18 timestamped observations are arranged from 2009-05-07 to 2026-07-08. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
4 relationship group(s) provide pivot and infrastructure context.
Last seen 22 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 6bdaf9b5_11.2.0.2 client win32.iso.bin
- File type
- isoimage
- MIME
- application/x-iso9660-image
- Size
- 644872192
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A file was accessed within the Public folder.
- A file with an unusual extension was attempted to be loaded as a DLL.
- A scripting utility was executed
- At least one IP Address, Domain, or File Name was found in a crypto call
- Binary contains paths to debug symbols
5 shown
View MITRE ATT&CK details · 5 shown
- T1036 · T1548 — A file was accessed within the Public folder.Tactics: TA0004 · TA0005
- T1059 · T1064 — A scripting utility was executedTactics: TA0002 · TA0005
- T1071 — At least one IP Address, Domain, or File Name was found in a crypto callTactics: TA0011
- T1082 — Checks available memoryTactics: TA0007
- T1497 · T1518.001 — Contains capabilities to detect virtual machinesTactics: TA0005 · TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- B0009.005 — Check Registry KeysObjectives: OB0001
- E1059 — Command and Scripting InterpreterObjectives: OB0009
- CommunicationObjectives: OC0006
- DiscoveryObjectives: OB0007
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 443, 80, 1900
- 5+ outbound connections observed
- 2 domains, 5+ IPs, 2 URLs
- Common ports: 443, 80, 1900
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- IP
- 209.197.3.8
- Port
- 80
- Protocol
- TCP
- IP
- 74.125.135.132
- Port
- 443
- Protocol
- TCP
- IP
- 239.255.255.250
- Port
- 1900
- Protocol
- UDP
- Domain
- go.microsoft.com
- URL
- http://go.microsoft.com/fwlink/?linkid=252669&clcid=0x409
- Protocol
- HTTP
- Domain
- dmd.metaservices.microsoft.com
- URL
- http://dmd.metaservices.microsoft.com/metadata.svc
- Protocol
- HTTP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- edge-consumer-static.azureedge.net
- Query
- clients2.googleusercontent.com
- Type
- A
- Answers
- 74.125.135.132
- Response
- NOERROR
- Query
- www.gstatic.com
- Type
- A
- Answers
- 172.217.218.94, 108.177.126.94
- Response
- NOERROR
- Query
- wpad.local
- Query
- update.googleapis.com
- Type
- A
- Answers
- 108.177.126.94
- Response
- NOERROR
5 shown