- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
777d112d7e01a6b7d65f01e74bbd76dd4042614b2ba65a03ba12a661fe753481- SHA1
4c7002a605fcfb6dfe18ffd81a9958daac33c0bf- MD5
182d64877ec6ac8f0dcca0554f782e08- Filename
- 777d112d_fil_dbde47fb24.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 642024
- Compile time
- 2097-06-26T21:27:22Z
- PE platform
- x64 64-bit
- PE sections
- 8
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
6 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context6 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
52%
high
peexe
3376584 bytes
contains
Filename
8d5299b5_9ee5f624e3ac.exe.bin
Family
penguish
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
26%
high
zip
14751133 bytes
contains
Filename
5ebc7c29_tmp-38262-daa1zhuzwd5q.zip.bin
Family
rugmi
Type
trojan
File type
zip
MIME
application/zip
48%
high
zip
5341256 bytes
drops
Filename
23e55185_sorgo.zip.bin
Family
rugmi
Type
trojan
File type
zip
MIME
application/zip
4%
high
zip
33638331 bytes
drops
Filename
f12c4b34_download.zip.bin
Type
trojan
File type
zip
MIME
application/zip
Size
33638331
5%
high
zip
11059111 bytes
drops
Filename
d5ad0d0d_com_srv_svc_v7_rc.zip.bin
Type
trojan
File type
zip
MIME
application/zip
Size
11059111
Dropped / child files
Files dropped, bundled, or created by the queried file.
1shown
0%
text
4096 bytes
contains
Filename
7e6c3008_fothk.bin
File type
text
MIME
text/plain
Size
4096
SHA1
11f44c798da8f6068aaf1465d7e874c6924a406a
Analysis details
dll64bitfile-overlaydebug-checkobfuscatedsigned
Freshness: Fresh · Last seen 2 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
777d112d7e01a6b7d65f01e74bbd76dd4042614b2ba65a03ba12a661fe753481- SHA1
4c7002a605fcfb6dfe18ffd81a9958daac33c0bf- MD5
182d64877ec6ac8f0dcca0554f782e08- Filename
- 777d112d_fil_dbde47fb24.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 642024
- Compile time
- 2097-06-26T21:27:22Z
- PE platform
- x64 64-bit
- PE sections
- 8
- Import libraries
- 29
- TLSH
T1CFD41827BB5906A1D16693BCA5C74306E3F1BC054721A3C742EBE26D2F2B7C8673B650- SSDEEP
12288:w+TTIwt0B5483RXXoTk3iUKQEKZm+jWodEEVUsS80v:58wdKnIk2QEKZm+jWodEEmsSN- Imphash
159edbab4bb09c4eda4aa8db6ba63d73- Richhash
e1f8833085adb04917defdf54ffb49aa- First seen
- 2026-03-27T20:41:35Z
- Last seen
- 2026-11-12T11:49:31Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
6 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
7 timestamped observations are arranged from 2010-06-27 to 2097-06-26. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Last seen 2 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 777d112d_fil_dbde47fb24.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 642024
- Compile time
- 2097-06-26T21:27:22Z
- PE platform
- x64 64-bit
- Entry point
- 164960
- Sections
- 8
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- AV process strings found (often used to terminate AV products)
- Authenticode signature is invalid
- Binary compilation timestomping detected
- Binary contains paths to debug symbols
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1036 · T1553.002 — Authenticode signature is invalidTactics: TA0005 · TA0112
- T1070.006 — Binary compilation timestomping detectedTactics: TA0005
- T1497 · T1518.001 — Checks if the current process is being debuggedTactics: TA0005 · TA0007
- T1542.003 — May use bcdedit to modify the Windows boot settingsTactics: TA0003 · TA0005
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- CommunicationObjectives: OC0006
- C0045 — Copy FileObjectives: OC0001
- Defense EvasionObjectives: OB0006
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
- Compile time: 2097-06-26T21:27:22Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 164960
- Sections
- 8
- Compile time
- 2097-06-26T21:27:22Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: r, rw, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 331562
- Raw size
- 331776
- Permissions
- rx
- Entropy
- 6.29
- Name
- fothk
- Virtual address
- 335872
- Virtual size
- 4096
- Raw size
- 4096
- Permissions
- rx
- Entropy
- 0.02
- Name
- .rdata
- Virtual address
- 339968
- Virtual size
- 242698
- Raw size
- 245760
- Permissions
- r
- Entropy
- 5.44
- Name
- .data
- Virtual address
- 585728
- Virtual size
- 47072
- Raw size
- 8192
- Permissions
- rw
- Entropy
- 3.82
- Name
- .pdata
- Virtual address
- 634880
- Virtual size
- 19776
- Raw size
- 20480
- Permissions
- r
- Entropy
- 5.63
5 shown
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- api-ms-win-crt-string-l1-1-0.dll
- Functions
- __strncnt, memset, strcspn, wcsnlen
- Library
- api-ms-win-crt-math-l1-1-0.dll
- Functions
- copysign, copysignf
- Library
- api-ms-win-crt-locale-l1-1-0.dll
- Functions
- _lock_locales, _unlock_locales
- Library
- api-ms-win-crt-runtime-l1-1-0.dll
- Functions
- _initterm, _initterm_e
- Library
- api-ms-win-crt-private-l1-1-0.dll
- Functions
- __AdjustPointer, __C_specific_handler, __current_exception, __current_exception_context, __CxxFrameHandler3, __GetPlatformExceptionInfo, __std_terminate, __uncaught_exception …
5 shown
Exports5+
5+ exported items
- 5+ exported items
View details · 5 shown
- Name
- ??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
- Name
- ??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
- Name
- ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z
- Name
- ??0?$_Yarn@D@std@@QEAA@AEBV01@@Z
- Name
- ??0?$_Yarn@D@std@@QEAA@PEBD@Z
5 shown
Resources1
1 resources
- 1 resources
- Resource types: RT_VERSION
View details · 1 shown
- Type
- RT_VERSION
- Language
- ENGLISH US
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5
3 issuers
- Example subject: Microsoft Windows
- Issued by: Microsoft Windows Production PCA 2011
- Validity period (UTC): 2025-11-13 – 2026-10-18
View details · 5 shown
- Subject
- Microsoft Windows
- Issuer
- Microsoft Windows Production PCA 2011
- Valid from
- 1763062440.0
- Valid to
- 1792352040.0
- Fingerprint
- 3EE4E719F74DDA999C1081F17F0F05EDA6A5FF4D
- Subject
- Microsoft Windows Production PCA 2011
- Issuer
- Microsoft Root Certificate Authority 2010
- Valid from
- 1319049660.0
- Valid to
- 1792435860.0
- Fingerprint
- 580A6F4CC4E4B669B9EBDC1B2B3E087B80D0678D
- Subject
- Microsoft Root Certificate Authority 2010
- Issuer
- Microsoft Root Certificate Authority 2010
- Valid from
- 1277330220.0
- Valid to
- 2066249040.0
- Fingerprint
- 3B1EFD3A66EA28B16697394703A72CA340A05BD5
- Subject
- Microsoft Time-Stamp Service
- Issuer
- Microsoft Time-Stamp PCA 2010
- Fingerprint
- F18AEEB662A94ABB9B09A018B14E29B7516DF036
- Subject
- Microsoft Time-Stamp PCA 2010
- Issuer
- Microsoft Root Certificate Authority 2010
- Fingerprint
- 36056A5662DCADECF82CC14C8B80EC5E0BCC59A6