Report - 8b1134784d8b…6fee2fca22

No detections FILE

Quota 44

First seen: 2025-11-27T21:08:12Z
Last seen: 2026-10-28T03:49:02Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS7Connections in this report

ANALYSISNo detectionsRecent

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: 8b1134784d8babc6ef24569abba93e20917679c51cd777de972bdc6fee2fca22
SHA1: b43e4c935b2ecda48a88ff79868a41610f029cf4
MD5: 5368a0eda501b5bd821bb55664d04f6f
Filename: 8b113478_unknown.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 307208
Compile time: 2012-12-05T19:31:13Z
PE platform: x64 64-bit
PE sections: 8

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

7 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context7 visible

Intelligence freshnessRecent

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

7 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

a8bdb8deeaae98d3472570be9bf3264328f84d2ee050e61b233895ffcdcd47e5

26% critical zip 152241902 bytes contains

Filename a8bdb8de_quantum-module-github.com-5.32.2.zip.bin Family password Type trojan File type zip MIME application/zip

93ed1156a7c7328a282f2fdf6d6f1d86b7baed18bf3e22d725b095cbee6ed691

9% high zip 141329757 bytes contains

Filename 93ed1156_roccat-swarm-github-io-1.19.2.zip.bin Type malware File type zip MIME application/zip Size 141329757

7c09dae45a39c11f00de135663b037c73820920c2efc99a0f81608706c9e6873

27% high zip 150073306 bytes contains

Filename 7c09dae4_lspdfr-gta5-github-io-3.23.6.zip.bin Family yttup Type trojan File type zip MIME application/zip

79263b50f258d7453f6af076263c5656047c120a72dfd636207e77982a7aed57

5% high zip 169952992 bytes contains

Filename 79263b50_glasswire-app-github-io-1.72.2.zip.bin Type trojan File type zip MIME application/zip Size 169952992

76b51c70f76e4305c7b95ee461d4dac26d51a4ac1a5522313ba284866902e637

27% critical zip 136648371 bytes contains

Filename 76b51c70_nexus-system-github.com-2.25.2.zip.bin Family lumma Type trojan File type zip MIME application/zip

Dropped / child files

Files dropped, bundled, or created by the queried file.

2shown

a71f8da53912f9f866c7dfde995a7544fda7e0b146ca5d88273ab7a1539c18c1

0% 4096 bytes contains

Filename a71f8da5_.data.bin MIME application/octet-stream Size 4096 SHA1 85c7871500928fb5ad0eca8b05b0075099194363 First seen 2026-01-08T21:42:35Z

ebbf0d8a53ac02656dbe73ef450aad249ad40f0c775b8f5351fb2e207454f114

0% text 4096 bytes contains

Filename ebbf0d8a_fothk.bin File type text MIME text/plain Size 4096 SHA1 4a8ff269ec13b74a5323c20ba892b45db24e4651

Analysis details

dlldebug-check64bitlegitfile-overlayknownsrcobfuscatedsigned

Freshness: Recent · Last seen 17 days ago.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 8b1134784d8babc6ef24569abba93e20917679c51cd777de972bdc6fee2fca22
SHA1: b43e4c935b2ecda48a88ff79868a41610f029cf4
MD5: 5368a0eda501b5bd821bb55664d04f6f
Filename: 8b113478_unknown.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 307208
Compile time: 2012-12-05T19:31:13Z
PE platform: x64 64-bit
PE sections: 8
Import libraries: 22
TLSH: T1C564291EF6A548A9DC7AC23DC5478226A7F2B9601352C7CF06508639EE1B7DA2F35F40
SSDEEP: 3072:uksV22GHg8RMkkKht2MST0SwDiANhsXmB/0WHZOVYOPaq0CQlmz3G7d:ukseHHRMkOMST0SwDiANmX+tZ/ZmY
Imphash: 07a76aeaf1db7fd5ee653602abcf0c84
Richhash: 8d3073d100b43ee3ac52ce12b0b5fe24
First seen: 2025-11-27T21:08:12Z
Last seen: 2026-10-28T03:49:02Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

7 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

8 timestamped observations are arranged from 2012-12-05 to 2026-01-08. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 7 visible

2 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Recent

Last seen 17 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 8b113478_unknown.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
Size: 307208
Compile time: 2012-12-05T19:31:13Z
PE platform: x64 64-bit
Entry point: 60304
Sections: 8

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
AV process strings found (often used to terminate AV products)
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
Binary contains paths to debug symbols
Checks if the current process is being debugged

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007
T1562.001 — Launches processes in debugging mode, may be used to hinder debugging
Tactics: TA0005
T1542.003 — May use bcdedit to modify the Windows boot settings
Tactics: TA0003 · TA0005
T1082 — Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software
Tactics: TA0007

5 shown

View MBC details · 5 shown

C0040 — Allocate Thread Local Storage
Objectives: OC0003
Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0032.020 — Argument Obfuscation
Objectives: OB0002
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity1

UDPports 53

1 outbound connections observed
0 domains, 1 IPs, 0 URLs
Common ports: 53
Protocols: UDP

View details · 1 shown

IP: 162.159.36.2
Port: 53
Protocol: UDP

DNS request activity3

A5+ response IPs

3 DNS requests observed
3 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 3 shown

Query: nexusrules.officeapps.live.com
Type: A
Answers: 150.171.110.2, 150.171.109.114, 150.171.109.150, 150.171.110.145, 150.171.109.178, 150.171.109.146, 150.171.109.74
Response: NOERROR

Query: eip-terr-na.cdp1.digicert.com.akahost.net
Type: A
Answers: 23.11.32.159
Response: NOERROR

Query: a1672.dscr.akamai.net
Type: A
Answers: 23.55.236.131, 23.55.236.137
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2012-12-05T19:31:13Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 60304
Sections: 8
Compile time: 2012-12-05T19:31:13Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 140604
Raw size: 143360
Permissions: rx
Entropy: 6.2

Name: fothk
Virtual address: 147456
Virtual size: 4096
Raw size: 4096
Permissions: rx
Entropy: 0.02

Name: .rdata
Virtual address: 151552
Virtual size: 111198
Raw size: 114688
Permissions: r
Entropy: 4.05

Name: .data
Virtual address: 266240
Virtual size: 5152
Raw size: 4096
Permissions: rw
Entropy: 1.36

Name: .pdata
Virtual address: 274432
Virtual size: 6396
Raw size: 8192
Permissions: r
Entropy: 4.55

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: api-ms-win-core-crt-l1-1-0.dll
Functions: __C_specific_handler, _vsnprintf_s, _vsnwprintf_s, _wcsicmp, _wcsnicmp, memcmp, memcpy, memcpy_s …

Library: api-ms-win-core-crt-l2-1-0.dll
Functions: __dllonexit3, _initterm, _initterm_e, _onexit, _purecall

Library: ntdll.dll
Functions: DbgPrintEx, NtAllocateLocallyUniqueId, NtClose, NtDeviceIoControlFile, NtDuplicateObject, NtFreeVirtualMemory, NtOpenEvent, NtOpenFile …

Library: RPCRT4.dll
Functions: I_RpcExceptionFilter, I_RpcMapWin32Status, NdrClientCall3, NdrServerCall2, NdrServerCallAll, RpcBindingBind, RpcBindingCreateW, RpcBindingFree …

Library: api-ms-win-core-errorhandling-l1-1-0.dll
Functions: GetLastError, SetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter

5 shown

Exports5+

5+ exported items

5+ exported items

View details · 5 shown

Name: AcceptSecurityContext

Name: AcquireCredentialsHandleA

Name: AcquireCredentialsHandleW

Name: AddCredentialsA

Name: AddCredentialsW

5 shown

Resources1

1 resources

1 resources
Resource types: RT_VERSION

View details · 1 shown

Type: RT_VERSION
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

3 issuers

Example subject: Microsoft Windows
Issued by: Microsoft Windows Production PCA 2011
Validity period (UTC): 2025-06-19 – 2026-06-17

View details · 5 shown

Subject: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011
Valid from: 1750356660.0
Valid to: 1781719860.0
Fingerprint: 3B77DB29AC72AA6B5880ECB2ED5EC1EC6601D847

Subject: Microsoft Windows Production PCA 2011
Issuer: Microsoft Root Certificate Authority 2010
Valid from: 1319049660.0
Valid to: 1792435860.0
Fingerprint: 580A6F4CC4E4B669B9EBDC1B2B3E087B80D0678D

Subject: Microsoft Root Certificate Authority 2010
Issuer: Microsoft Root Certificate Authority 2010
Valid from: 1277330220.0
Valid to: 2066249040.0
Fingerprint: 3B1EFD3A66EA28B16697394703A72CA340A05BD5

Subject: Microsoft Time-Stamp Service
Issuer: Microsoft Time-Stamp PCA 2010
Fingerprint: 7CEFADAB3D341DEC89C309075BD6480529090244

Subject: Microsoft Time-Stamp PCA 2010
Issuer: Microsoft Root Certificate Authority 2010
Fingerprint: 36056A5662DCADECF82CC14C8B80EC5E0BCC59A6

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check