Report - 948e3c74eef1…b949774824

Suspicious HighFILE

Quota 40

First seen: 2026-10-16T04:07:40Z
Last seen: 2026-11-12T21:42:08Z

THREAT SIGNALLow Read alongside the verdict

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedtrojan

RELATED INDICATORS23Connections in this report

ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: 948e3c74eef138499709e414b65ab0490478202d6929439b1a6641b949774824
SHA1: 8893852f2eaf827d1862786b1b4fb019ae3ff2da
MD5: 7d5ae52e4b47579eeb0342ad0d59fcfb
Filename: 948e3c74_geek uninstaller.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 11980432
Compile time: 2026-10-14T11:20:34Z
PE platform: x86 32-bit
PE sections: 5

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Threat context

Classification includes type trojan.

Analysis signals

OBSERVED

Engine detections4%

Relationship context23 visible

Threat classificationtrojan

Intelligence freshnessFresh

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

23 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

fce8a28533115a9c8ae3c2b406732992d73323e01c93518a61961e5b26d31b20

5% high zip 33249182 bytes contains

Filename fce8a285_descargas.zip.bin Type trojan File type zip MIME application/zip Size 33249182

0959ccb4fcae13512ccba5f57317981926869766d55be881fbec1b7951e5e1ad

91% critical peexe 12742656 bytes contains

Filename 0959ccb4fcae13512ccba5f57317981926869766d55be881fbec1b7951e5e1ad Family darkkomet Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

0b27f24e4d4273cb526d68ab6a8b839d08e86461d059f14624334c4ae197bbe9

20% high vba 2828 bytes drops

Filename 0b27f24e_geek.bat.bin Family alien Type downloader File type vba MIME text/plain

e572ea25ae05288f6a9ebcaea4f85d41114ae04a3fc60cf53f8739a4e0dea542

91% high peexe 12751872 bytes contains

Filename e572ea25_gjdnad.exe.bin Family darkkomet Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

457243e5f126810e11b8cf4289adff3dfc23b624dbae99aa3f5b9743cc03592a

5% high rar 3719245 bytes contains

Filename 457243e5f126810e11b8cf4289adff3dfc23b624dbae99aa3f5b9743cc03592a.file Type trojan File type rar MIME application/vnd.rar Size 3719245

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

342ea84255d3bc59be5c5edad040c49b8ee46582fca4b2a430c9af23a9cfb0dd

0% ico 2238 bytes contains

Filename 342ea842_37.ico.bin File type ico MIME application/octet-stream Size 2238 SHA1 efda7cbc1f26e3d17b954d0337033e5b74356a15

1c2155ea92caaa134c567e5325b31cecfaee0ae5395884d2305a82a93bcfb552

0% 618 bytes contains

Filename 1c2155ea_9356.bin MIME application/octet-stream Size 618 SHA1 d4a7105b528ee3195adaff497b654c0a8d1270ec First seen 2013-02-26T21:37:29Z

68d542ed291df04d535fff19675f743ef4707dae55caea57c7a4e6df7f98368d

0% ico 1406 bytes contains

Filename 68d542ed_120.ico.bin File type ico MIME application/octet-stream Size 1406 SHA1 2ea12cae0eed64b032186f7f4e398d98c0c41182

7bb77d0be6dcfb91153af64d65de962803b63dc53f9ee1049505f23ec8c76dfe

0% ico 1758 bytes contains

Filename 7bb77d0b_53.ico.bin File type ico MIME application/octet-stream Size 1758 SHA1 69d3785ee5a9637227aede5b564092b19c0b6d05

10889476eddc528a08981b09069b1c391212cb1014d2dda9f9faf97872d1f5b1

0% 160 bytes contains

Filename 10889476_3316.bin MIME application/octet-stream Size 160 SHA1 7ded3628c9d0c0471029493fc7be7b62932e4640 First seen 2016-04-05T00:07:19Z

Related IPs

Network IPs associated with this indicator.

5shown

23.212.251.216

0% US communicates

CIDR 23.212.224.0/19 Network 23.192.0.0-23.223.255.255 First seen 2023-12-17T01:11:14Z Last seen 2026-11-14T04:33:00Z

173.230.144.164

5% low US communicates

CIDR 173.230.128.0/19 Network 173.230.128.0-173.230.159.255 First seen 2023-09-30T08:12:46Z Last seen 2026-11-14T15:08:03Z

92.223.96.6

5% high US communicates

CIDR 92.223.96.0/22 Network 92.223.92.0-92.223.102.255 First seen 2025-10-16T01:11:08Z Last seen 2026-11-14T17:09:42Z

23.34.125.115

0% US communicates

CIDR 23.34.124.0/22 Network 23.32.0.0-23.67.255.255 First seen 2025-09-11T05:46:48Z Last seen 2026-11-14T17:06:44Z

104.18.21.213

0% US communicates

CIDR 104.16.0.0/14 Network 104.16.0.0-104.31.255.255 First seen 2023-10-04T08:10:46Z Last seen 2026-11-14T17:06:44Z

Related domains

Domains associated with this indicator.

5shown

yr.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr.c First seen 2025-11-04T11:49:44Z Last seen 2026-11-14T16:58:03Z

yr2.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr2.c First seen 2026-01-07T19:14:52Z Last seen 2026-11-14T15:01:18Z

geekuninstaller.com

0% .com communicates

Root geekuninstaller.com TLD com First seen 2023-03-12T07:28:08Z Last seen 2026-11-13T19:10:07Z

c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain c First seen 2023-09-29T22:23:03Z Last seen 2026-11-14T17:06:44Z

cl-glcb907925.gcdn.co

5% low .co communicates

Root gcdn.co TLD co Subdomain cl-glcb907925 First seen 2025-07-06T03:15:52Z Last seen 2026-11-14T17:09:42Z

Related URLs

URLs associated with this indicator.

3shown

http://yr2.c.lencr.org/41.crl

0% communicates

TLD org HTTP status 200 Content length 251934 Content SHA256 7e0756db9390a630dc5d3c7d5fce7bb09d3343133ce41f8458e9814bf001a5de First seen 2026-06-21T19:05:06Z

http://geekuninstaller.com:443/

4% low communicates

TLD com HTTP status 400 Content length 657 Content SHA256 fb6fb60b5d2a4fc44c71844bf0d12aad3ffb193ed2a7aed38001a09e0af1c03a First seen 2021-08-25T13:07:11Z

https://geekuninstaller.com/update.txt

0% communicates

TLD com HTTP status 200 Content length 71 Content SHA256 ad0a2327be6b5619e5559298b0180639ddcc62fd55d6ad8fe3fce41cfa46b7b7 First seen 2017-07-21T05:03:21Z

Analysis details

Severity: hightrojanfile-overlayexeobfuscatedsigned

Freshness: Fresh · Last seen 1 day ago.

Detection rate: 4%
Threat type: trojan
detection: 4 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 948e3c74eef138499709e414b65ab0490478202d6929439b1a6641b949774824
SHA1: 8893852f2eaf827d1862786b1b4fb019ae3ff2da
MD5: 7d5ae52e4b47579eeb0342ad0d59fcfb
Filename: 948e3c74_geek uninstaller.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 11980432
Compile time: 2026-10-14T11:20:34Z
PE platform: x86 32-bit
PE sections: 5
Import libraries: 19
TLSH: T1B9C68D5176DC84E5E1D2C27CCD598A5AEA3BF8254B3082CF319D070DAF776D18E7A222
SSDEEP: 196608:jy4NvXxvIQBzaQR504E/YkG4Y9AY9p6nJS:jFvfRa6S/YklYn6n8
Imphash: c3059cf0fda04abb514a6832b76a7df6
Richhash: b3b2f0936b21434104a4a7078e4b26ec
First seen: 2026-10-16T04:07:40Z
Last seen: 2026-11-12T21:42:08Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (4%).

Threat context

Classification includes type trojan.

Relationship context

23 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

24 timestamped observations are arranged from 1992-06-19 to 2026-11-01. These are observation or metadata times, not execution order.

Infrastructure geography

5 infrastructure/location point(s) are visible on the map. 1 point(s) are country-level approximate.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 4%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

Relationship context 23 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification trojan

Classification context: type trojan.

Intelligence freshness Fresh

Last seen 1 day ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 948e3c74_geek uninstaller.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 11980432
Compile time: 2026-10-14T11:20:34Z
PE platform: x86 32-bit
Entry point: 1754533
Sections: 5

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscated

View details · 5 shown

Authenticode signature is invalid
Binary contains paths to debug symbols
Classification label
Creates files inside the user directory
Creates mutexes

5 shown

View MITRE ATT&CK details · 5 shown

T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1036 — Creates files inside the user directory
Tactics: TA0005
T1071 — Detected HTTP requests to some non white-listed domains
Tactics: TA0011
T1112 · T1185 — Detected an attempt to write registry keys related to the proxy settings
Tactics: TA0003 · TA0009 · TA0112
T1027.009 — Drops interesting files and uses them
Tactics: TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Communication
Objectives: OC0006
B0002 — Debugger Evasion
Objectives: OB0001
Defense Evasion
Objectives: OB0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 80, 443, 53

5+ outbound connections observed
2 domains, 5+ IPs, 4 URLs
Common ports: 80, 443, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: geekuninstaller.com
URL: http://geekuninstaller.com:443/
Protocol: HTTP

IP: 8.8.8.8
Port: 53
Protocol: UDP

IP: 199.232.210.172
Port: 80
Protocol: TCP

IP: 173.230.144.164
Port: 443
Protocol: TCP

Domain: geekuninstaller.com
URL: https://geekuninstaller.com/update.txt
Protocol: HTTP

5 shown

DNS request activity5

A4 response IPs

5 DNS requests observed
5 unique queries
4 response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: cl-glcb907925.gcdn.co
Type: A
Answers: 92.223.96.6
Response: NOERROR

Query: yr2.c.lencr.org
Type: A
Answers: 104.18.20.213, 104.18.21.213
Response: NOERROR

Query: yr.c.lencr.org

Query: x1.c.lencr.org

Query: geekuninstaller.com
Type: A
Answers: 173.230.144.164
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5 sections

Platform: x86 32-bit
Sections: 5
Entry point: present
Compile time: 2026-10-14T11:20:34Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 1754533
Sections: 5
Compile time: 2026-10-14T11:20:34Z

PE sections5

5 sections

5 PE sections
Common permissions: r, rw, rx
5 unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 2107315
Raw size: 2107392
Permissions: rx
Entropy: 6.56

Name: .rdata
Virtual address: 2113536
Virtual size: 617592
Raw size: 617984
Permissions: r
Entropy: 5.66

Name: .data
Virtual address: 2732032
Virtual size: 66700
Raw size: 46592
Permissions: rw
Entropy: 4.88

Name: .fptable
Virtual address: 2801664
Virtual size: 128
Raw size: 512
Permissions: rw
Entropy: 0.0

Name: .rsrc
Virtual address: 2805760
Virtual size: 9182960
Raw size: 9183232
Permissions: r
Entropy: 6.62

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: AcquireSRWLockExclusive, CloseHandle, CompareFileTime, CompareStringEx, CompareStringW, CreateDirectoryW, CreateEventW, CreateFileMappingW …

Library: USER32.dll
Functions: AdjustWindowRectEx, AppendMenuW, BeginDeferWindowPos, BeginPaint, BringWindowToTop, CallNextHookEx, CallWindowProcW, CharLowerBuffA …

Library: GDI32.dll
Functions: BeginPath, BitBlt, CloseFigure, CombineRgn, CreateBitmap, CreateCompatibleBitmap, CreateCompatibleDC, CreateDCW …

Library: MSIMG32.dll
Functions: GradientFill

Library: WINSPOOL.DRV
Functions: ClosePrinter, DocumentPropertiesW, OpenPrinterW

5 shown

Resources5+

5+ resources

5+ resources
Resource types: XML, RT_ICON, RT_CURSOR, RT_BITMAP, BIN

View details · 5 shown

Type: BIN
Language: ENGLISH US

Type: PNG
Language: NEUTRAL

Type: XML
Language: NEUTRAL

Type: RT_CURSOR
Language: NEUTRAL

Type: RT_BITMAP
Language: NEUTRAL

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5+ issuers

Example subject: CrystalBit Solutions
Issued by: Sectigo Public Code Signing CA R36
Validity period (UTC): 2026-02-13 – 2029-04-13

View details · 5 shown

Subject: CrystalBit Solutions
Issuer: Sectigo Public Code Signing CA R36
Valid from: 1770940800.0
Valid to: 1870819140.0
Fingerprint: D2160F2D80588DB473734D2176DD185A5106C0CF

Subject: Sectigo Public Code Signing CA R36
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2089756740.0
Fingerprint: 0BC5E76773D2E44FC9903D4DFEFE451553BBEC4A

Subject: Sectigo Public Code Signing Root R46
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2405289540.0
Fingerprint: CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D

Subject: Sectigo Public Code Signing Root R46
Issuer: AAA Certificate Services
Fingerprint: 329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692

Subject: Sectigo Public Time Stamping Root R46
Issuer: USERTrust RSA Certification Authority
Fingerprint: 853D632D938282617CD09035C491DE92C142DAC7

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check