- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
839cdf4c00e5ff564f8337aba16ad7bbe8f02edd2b5c908b5daca31d88a6cdd1- SHA1
16e78547a444f6aac6ca9848f01c9bd9a8ddf133- MD5
fcc5598a3fe4cc5b88b7ee2f1d56eb63- Filename
- 839cdf4c_utm-guest-tools-0.1.271.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 78488152
- Compile time
- 2024-03-30T16:55:19Z
- PE platform
- x86 32-bit
- PE sections
- 5
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Relationship context
16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections5%
Relationship context16 visible
Intelligence freshnessHistorical
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
0%
isoimage
127084544 bytes
drops
Filename
65b6a69b_utm-guest-tools-0.1.271.iso.bin
File type
isoimage
MIME
application/x-iso9660-image
Size
127084544
SHA1
dc25e0918699bc4cfbcb171be4bd4e4bfa813876
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
peexe
103024 bytes
drops
Filename
1b2f5170_setd461.tmp.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
103024
Compile time
2020-11-20T19:22:56Z
0%
peexe
192808 bytes
contains
Filename
0d3ff7e9_viogpuap.exe.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
192808
Compile time
2023-07-22T01:52:54Z
0%
8869 bytes
contains
Filename
029516b5_oem58.cat.bin
MIME
application/vnd.ms-pki.seccat
Size
8869
SHA1
6e31849e38969458e480bb7d16d6ddca4e790bf6
First seen
2024-01-16T02:23:33Z
0%
msi
11770368 bytes
drops
Filename
22230284_3ccc16.msi.bin
File type
msi
MIME
application/x-msi
Size
11770368
SHA1
a9b7eb7ec626a53a63f434281b9048e42f7c8cb7
0%
peexe
188608 bytes
drops
Filename
617968ba_file_netkvm_w10_amd64.sys.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
188608
Compile time
2025-01-14T02:19:40Z
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2026-05-18T07:53:38Z
Last seen
2026-11-15T05:36:18Z
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2026-06-17T05:43:16Z
Last seen
2026-11-15T05:36:18Z
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2026-05-30T21:50:37Z
Last seen
2026-11-15T05:56:23Z
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2026-05-31T09:56:52Z
Last seen
2026-11-15T07:57:19Z
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2026-05-31T08:31:31Z
Last seen
2026-11-15T04:25:13Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
identrust.com
TLD
com
Subdomain
secure
First seen
2025-02-03T22:47:57Z
Last seen
2026-05-13T11:09:54Z
0%
.com
communicates
Root
identrust.com
TLD
com
Subdomain
validation
First seen
2023-09-29T19:56:23Z
Last seen
2026-11-10T15:01:57Z
0%
.co
communicates
Root
globalcdn.co
TLD
co
Subdomain
cl-glcb907925
First seen
2025-07-06T01:33:21Z
Last seen
2026-11-15T08:13:04Z
0%
.net
communicates
Root
edgesuite.net
TLD
net
Subdomain
windows.msn.com-ion
First seen
2025-05-31T02:06:55Z
Last seen
2026-11-15T08:13:52Z
0%
.com
communicates
Root
live.com
TLD
com
Subdomain
nexusrules.officeapps
First seen
2023-09-29T01:11:46Z
Last seen
2026-11-15T08:14:03Z
Analysis details
Severity: lowexefile-overlaycryptopersistence
Freshness: Historical · Last seen 185 days ago.
- Detection rate
- 5%
- detection
- 5 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
839cdf4c00e5ff564f8337aba16ad7bbe8f02edd2b5c908b5daca31d88a6cdd1- SHA1
16e78547a444f6aac6ca9848f01c9bd9a8ddf133- MD5
fcc5598a3fe4cc5b88b7ee2f1d56eb63- Filename
- 839cdf4c_utm-guest-tools-0.1.271.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 78488152
- Compile time
- 2024-03-30T16:55:19Z
- PE platform
- x86 32-bit
- PE sections
- 5
- Import libraries
- 7
- TLSH
T1F108332DD619C425CC7C9BBFCAFFA451378F9B9BA3A8C5350106C72F693E226B540612- SSDEEP
1572864:InDAZLuylRcBOK2bCeEnLhxJE3+WnCunBCiwJf2UyG+cRVv6/G:In2CkWHaCDxJ5boc+u- Imphash
9dda1a1d1f8a1d13ae0297b47046b26e- Richhash
ea665d1587c4e6a30af5ae0282aa3786- First seen
- 2025-07-29T01:13:13Z
- Last seen
- 2026-05-14T07:31:08Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (5%).
Relationship context
16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
17 timestamped observations are arranged from 2020-11-20 to 2026-06-17. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Intelligence freshness
Last seen 185 days ago. Revalidate volatile infrastructure before enforcement.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
4 relationship group(s) provide pivot and infrastructure context.
Last seen 185 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 839cdf4c_utm-guest-tools-0.1.271.exe.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 78488152
- Compile time
- 2024-03-30T16:55:19Z
- PE platform
- x86 32-bit
- Entry point
- 13925
- Sections
- 5
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A file with an unusual extension was attempted to be loaded as a DLL.
- Anomalous binary characteristics
- Anomalous file deletion behavior detected (10+)
- At least one IP Address, Domain, or File Name was found in a crypto call
- Attempts to connect to a dead IP:Port (2 unique times)
5 shown
View MITRE ATT&CK details · 5 shown
- T1071 — Anomalous binary characteristicsTactics: TA0011
- T1485 — Anomalous file deletion behavior detected (10+)Tactics: TA0040
- T1036 · T1055 — Attempts to make a network connection via suspicious processTactics: TA0004 · TA0005
- T1082 — Checks available memoryTactics: TA0007
- T1543.003 — Created a service that was not startedTactics: TA0003 · TA0004
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- E1010 — Application Window DiscoveryObjectives: OB0007
- F0013 — BootkitObjectives: OB0006 · OB0012
- C0032.001 — CRC32Objectives: OC0004
- B0009.005 — Check Registry KeysObjectives: OB0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5
TCP, UDPports 443, 80, 53
- 5 outbound connections observed
- 0 domains, 5 IPs, 0 URLs
- Common ports: 443, 80, 53
- Protocols: TCP, UDP
View details · 5 shown
- IP
- 23.216.147.41
- Port
- 443
- Protocol
- TCP
- IP
- 23.196.145.221
- Port
- 80
- Protocol
- TCP
- IP
- 217.20.54.38
- Port
- 80
- Protocol
- TCP
- IP
- 20.99.133.109
- Port
- 443
- Protocol
- TCP
- IP
- 162.159.36.2
- Port
- 53
- Protocol
- UDP
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- windows.msn.com-ion.edgesuite.net
- Query
- res.public.onecdn.static.microsoft
- Type
- A
- Answers
- 23.216.147.41, 23.216.147.22, 23.216.147.23, 23.216.147.7, 23.216.147.32, 23.216.147.6, 23.216.147.35, 23.216.147.37 …
- Response
- NOERROR
- Query
- nexusrules.officeapps.live.com
- Type
- A
- Answers
- 52.111.227.14
- Response
- NOERROR
- Query
- cl-glcb907925.globalcdn.co
- Type
- A
- Answers
- 92.223.96.6
- Response
- NOERROR
- Query
- bg.microsoft.map.fastly.net
- Type
- A
- Answers
- 199.232.210.172, 199.232.214.172
- Response
- NOERROR
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit5 sections
- Platform: x86 32-bit
- Sections: 5
- Entry point: present
- Compile time: 2024-03-30T16:55:19Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 13925
- Sections
- 5
- Compile time
- 2024-03-30T16:55:19Z
PE sections5
5 sections
- 5 PE sections
- Common permissions: r, rw, rx
- 5 unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 26327
- Raw size
- 26624
- Permissions
- rx
- Entropy
- 6.44
- Name
- .rdata
- Virtual address
- 32768
- Virtual size
- 4952
- Raw size
- 5120
- Permissions
- r
- Entropy
- 5.1
- Name
- .data
- Virtual address
- 40960
- Virtual size
- 129912
- Raw size
- 1536
- Permissions
- rw
- Entropy
- 4.12
- Name
- .ndata
- Virtual address
- 172032
- Virtual size
- 147456
- Raw size
- 0
- Permissions
- rw
- Entropy
- 0.0
- Name
- .rsrc
- Virtual address
- 319488
- Virtual size
- 16888
- Raw size
- 16896
- Permissions
- r
- Entropy
- 6.04
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- ADVAPI32.dll
- Functions
- AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegCloseKey, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyW …
- Library
- SHELL32.dll
- Functions
- SHBrowseForFolderW, ShellExecuteExW, SHFileOperationW, SHGetFileInfoW, SHGetPathFromIDListW
- Library
- ole32.dll
- Functions
- CoCreateInstance, CoTaskMemFree, IIDFromString, OleInitialize, OleUninitialize
- Library
- COMCTL32.dll
- Functions
- ImageList_AddMasked, ImageList_Create, ImageList_Destroy, Ord(17)
- Library
- USER32.dll
- Functions
- AppendMenuW, BeginPaint, CallWindowProcW, CharNextA, CharNextW, CharPrevW, CheckDlgButton, CloseClipboard …
5 shown
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_MANIFEST
View details · 4 shown
- Type
- RT_ICON
- Language
- ENGLISH US
- Type
- RT_DIALOG
- Language
- ENGLISH US
- Type
- RT_GROUP_ICON
- Language
- ENGLISH US
- Type
- RT_MANIFEST
- Language
- ENGLISH US