- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
81328417df6093203ef3f51b2e930f1a34d67a4e404d7c3d1d5269dc27cd64de- SHA1
e2b8165277dd9b6339956517206d99ca70adc395- MD5
805f899c179537a7e9bfe83b310dd0eb- Filename
- 81328417_dvnx.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 11829998
- TLSH
T1CAC6332D633ED549C89FACBF603206B134723C9133DD27AA9F68A64A2CD51B079C275D- SSDEEP
196608:WZdNuSkTYa5jXLoU1tHsNwSLl0H+gg233VxNLd2fDgv7bRa0+jJv0wctxOJ:WZb7k0a5jXLntH6l0H+gNhmy1a0mJ1ec
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
6 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context6 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
xml
38849 bytes
drops
Filename
5eb953de_registry_doc.xml.bin
File type
xml
MIME
application/xml
Size
38849
SHA1
0e646be0e749fac3298364f9ceabe56082a2acdb
0%
csv
123732 bytes
drops
Filename
5cbbe4d6_launcher_443.log.bin
File type
csv
MIME
text/plain
Size
123732
SHA1
4a8ed89bed2e3d5143af6965abb17d7d2d08545f
0%
text
9529 bytes
drops
Filename
4a424d40_preset_guide_470.txt.bin
File type
text
MIME
text/plain
Size
9529
SHA1
500ebaa3f3d5d943c415c7e2e61b180c790b1000
0%
csv
32638 bytes
drops
Filename
49a1e852_audit_records_885.csv.bin
File type
csv
MIME
text/plain
Size
32638
SHA1
da2118fb0c08e10b670bc88fd3129913265e85ce
0%
text
182197 bytes
drops
Filename
47bf1aff_loadout_apply_373.log.bin
File type
text
MIME
text/plain
Size
182197
SHA1
c81768fb221c4ae6c516f887a9773ce8d844cf31
Related IPs
Network IPs associated with this indicator.
1shown
0%
US
communicates
CIDR
162.159.0.0/18
Network
162.158.0.0-162.159.255.255
First seen
2023-09-30T16:06:22Z
Last seen
2026-11-14T06:10:33Z
Analysis details
encryptedzipdebug-checkexec-delay
Freshness: Fresh · Last seen 6 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
81328417df6093203ef3f51b2e930f1a34d67a4e404d7c3d1d5269dc27cd64de- SHA1
e2b8165277dd9b6339956517206d99ca70adc395- MD5
805f899c179537a7e9bfe83b310dd0eb- Filename
- 81328417_dvnx.zip.bin
- File type
- zip
- MIME
- application/zip
- File size
- 11829998
- TLSH
T1CAC6332D633ED549C89FACBF603206B134723C9133DD27AA9F68A64A2CD51B079C275D- SSDEEP
196608:WZdNuSkTYa5jXLoU1tHsNwSLl0H+gg233VxNLd2fDgv7bRa0+jJv0wctxOJ:WZb7k0a5jXLntH6l0H+gNhmy1a0mJ1ec- First seen
- 2026-11-05T23:57:20Z
- Last seen
- 2026-11-07T14:33:37Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
6 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
7 timestamped observations are arranged from 2023-09-30 to 2026-11-05. These are observation or metadata times, not execution order.
Infrastructure geography
1 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Last seen 6 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 81328417_dvnx.zip.bin
- File type
- zip
- MIME
- application/zip
- Size
- 11829998
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- Allocates memory with a write watch (potentially for evading sandboxes)
- Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
- At least one IP Address, Domain, or File Name was found in a crypto call
- Binary contains paths to debug symbols
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1497 — Allocates memory with a write watch (potentially for evading sandboxes)Tactics: TA0005 · TA0007
- T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patchingTactics: TA0004 · TA0005
- T1071 — At least one IP Address, Domain, or File Name was found in a crypto callTactics: TA0011
- T1082 — Checks available memoryTactics: TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- B0009.005 — Check Registry KeysObjectives: OB0001
- CommunicationObjectives: OC0006
- DiscoveryObjectives: OB0007
- C0002 — HTTP CommunicationObjectives: OC0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity1
UDPports 53
- 1 outbound connections observed
- 0 domains, 1 IPs, 0 URLs
- Common ports: 53
- Protocols: UDP
View details · 1 shown
- IP
- 162.159.36.2
- Port
- 53
- Protocol
- UDP