- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
8a4cebb344ec574f8b0a578b7f201f3fb6059c1a40eb4ef8fd16816e5a030c9a- SHA1
52c32cbebd455898547ab2729f63d57edbca25ff- MD5
c3b521aab47993a60efda9a4a1e45553- Filename
- c3b521aab47993a60efda9a4a1e45553.file
- File type
- doc
- MIME
- application/octet-stream
- File size
- 356352
- Filename variants
- 3 reported
- TLSH
T1AC746B3439EA401AF273EF765AD4B9AB9D6FFE333B06945A1051334A4632E81DE8113D- SSDEEP
6144:VCddIzHtiHs9fgvGZ5ewus8HtuBWfi1l9EFRwjKMoobNERN8R41wbkTPN:9HtGeZjkfi1l9EFRMKMoobSRGR41wyPN
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 43%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections43%
VirusSign confidence100%
Relationship context17 visible
Threat classificationsdrop
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
bat
46 bytes
drops
Filename
3903daac9bc4a3b7.timestamp
File type
bat
MIME
text/plain
Size
46
SHA1
eba26469deee72733354f412193ef2501535ca54
23%
high
jar
42262 bytes
drops
Filename
UpZbVlwR_g.jar
Family
java
Type
trojan
File type
jar
MIME
application/java-archive
0%
lnk
1051 bytes
drops
Filename
attachment.doc.LNK
File type
lnk
MIME
application/x-ms-shortcut
Size
1051
SHA1
24330545d0baa4d75ced322879dedac62178c93e
21%
high
vba
3095 bytes
contains
Filename
ThisDocument.cls
Family
bp1ke71dolm
Type
trojan
File type
vba
MIME
text/plain
0%
jar
7887 bytes
drops
Filename
Cj0pvnl9iUFHnYhafQHXC.jar
File type
jar
MIME
application/java-archive
Size
7887
SHA1
f3e668f0532fe82facb2a48a06cd01d235e5f2c3
Related IPs
Network IPs associated with this indicator.
5shown
6%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.0.0.0-150.255.255.255
First seen
2026-03-03T10:37:40Z
Last seen
2026-11-12T22:44:07Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-10-25T06:23:20Z
Last seen
2026-11-12T16:46:03Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-10-18T01:06:18Z
Last seen
2026-11-12T18:47:34Z
0%
US
communicates
CIDR
52.123.0.0/16
Network
52.120.0.0-52.123.255.255
First seen
2023-10-29T22:29:45Z
Last seen
2026-11-12T21:08:36Z
0%
FR
communicates
CIDR
23.1.240.0/20
Network
23.0.0.0-23.15.255.255
First seen
2023-09-30T16:26:35Z
Last seen
2026-11-12T19:15:50Z
Related domains
Domains associated with this indicator.
5shown
0%
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
atm.teams.mira.tm.svc
First seen
2024-08-26T16:41:58Z
Last seen
2026-11-12T22:58:21Z
0%
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
atm.office.mira.tm.svc
First seen
2024-08-26T16:41:58Z
Last seen
2026-11-12T22:19:14Z
0%
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
svc
First seen
2023-11-09T10:19:11Z
Last seen
2026-11-12T22:45:51Z
0%
.net
communicates
Root
office.net
TLD
net
Subdomain
uci.cdn
First seen
2023-09-30T19:52:13Z
Last seen
2026-11-12T22:19:14Z
5%
high
.net
communicates
Root
office.net
TLD
net
Subdomain
metadata.templates.cdn
First seen
2023-09-30T10:25:13Z
Last seen
2026-11-12T22:14:22Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
TLD
microsoft
HTTP status
400
Content SHA256
855bb50e73e6b2d1c6d6d69ee436c9dfcc5b390a49d50119f8f2eea677bcaefd
First seen
2025-08-22T00:53:09Z
Last seen
2026-11-12T22:45:51Z
5%
low
communicates
TLD
com
HTTP status
200
Content length
293
Content SHA256
0fbf7512a030085b0e374a55a7a7a600ae2027dc32455349111fb9e95a5d1039
First seen
2013-06-05T03:22:31Z
Analysis details
Severity: hightrojanexecenv-accesspersistencefile-createcryptofile-accessole-createadapter-discoveryobfuscatedmacrosfile-write
Freshness: Fresh · Last seen 2 days ago.
- Detection rate
- 43%
- Threat type
- trojan
- Family
- sdrop
- Confidence
- 100%
- detection
- 43 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
8a4cebb344ec574f8b0a578b7f201f3fb6059c1a40eb4ef8fd16816e5a030c9a- SHA1
52c32cbebd455898547ab2729f63d57edbca25ff- MD5
c3b521aab47993a60efda9a4a1e45553- Filename
- c3b521aab47993a60efda9a4a1e45553.file
- File type
- doc
- MIME
- application/octet-stream
- File size
- 356352
- TLSH
T1AC746B3439EA401AF273EF765AD4B9AB9D6FFE333B06945A1051334A4632E81DE8113D- SSDEEP
6144:VCddIzHtiHs9fgvGZ5ewus8HtuBWfi1l9EFRwjKMoobNERN8R41wbkTPN:9HtGeZjkfi1l9EFRMKMoobSRGR41wyPN- First seen
- 2026-11-04T16:53:11Z
- Last seen
- 2026-11-10T10:15:16Z
- Filename variants
- 3 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 43%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family sdrop.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
18 timestamped observations are arranged from 2013-06-05 to 2026-11-04. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family sdrop.
Last seen 2 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- c3b521aab47993a60efda9a4a1e45553.file
- File type
- doc
- MIME
- application/octet-stream
- Size
- 356352
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A document file initiated network communications indicative of a potential exploit or payload download
- A document or script file initiated network communications indicative of a potential exploit or payload download
- A file with an unusual extension was attempted to be loaded as a DLL.
- A ping command was executed with the -n argument possibly to delay analysis
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1071 · T1221 — A document file initiated network communications indicative of a potential exploit or payload downloadTactics: TA0005 · TA0011
- T1071 — A ping command was executed with the -n argument possibly to delay analysisTactics: TA0011
- T1564.003 — A process created a hidden windowTactics: TA0005
- T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven executionTactics: TA0004 · TA0005
5 shown
View MBC details · 5 shown
- B0030 — C2 CommunicationObjectives: OB0004
- Command and ControlObjectives: OB0004
- E1059 — Command and Scripting InterpreterObjectives: OB0009
- CommunicationObjectives: OC0006
- E1485 — Data DestructionObjectives: OB0008
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTPports 443, 80, 8080
- 5+ outbound connections observed
- 2 domains, 5 IPs, 2 URLs
- Common ports: 443, 80, 8080
- Protocols: TCP, HTTP
View details · 5 shown
- Domain
- ip-api.com
- URL
- http://ip-api.com/json/
- Protocol
- HTTP
- IP
- 208.95.112.1
- Port
- 80
- Protocol
- TCP
- Domain
- roaming.svc.cloud.microsoft
- URL
- https://roaming.svc.cloud.microsoft/rs/roamingsoapservice.svc
- Protocol
- HTTP
- IP
- 52.123.246.11
- Port
- 443
- Protocol
- TCP
- IP
- 52.110.7.43
- Port
- 443
- Protocol
- TCP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- metadata.templates.cdn.office.net
- Type
- A
- Answers
- 23.195.81.179, 23.195.81.147
- Response
- NOERROR
- Query
- ip-api.com
- Type
- A
- Answers
- 208.95.112.1
- Response
- NOERROR
- Query
- uci.cdn.office.net
- Type
- A
- Answers
- 23.1.254.223, 23.1.254.199, 23.1.254.215, 23.1.254.198, 23.1.254.222, 23.1.254.211
- Response
- NOERROR
- Query
- roaming.svc.cloud.microsoft
- Type
- A
- Answers
- 52.110.1.100
- Response
- NOERROR
- Query
- nexusrules.officeapps.live.com
- Type
- A
- Answers
- 150.171.110.211, 150.171.109.67, 150.171.109.153, 150.171.109.71, 150.171.110.3, 150.171.109.152, 150.171.110.148, 150.171.110.2 …
- Response
- NOERROR
5 shown