- First seen
- Last seen
THREAT SIGNALLow
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
9bd8e89f2a6c285e0772a237b1cc0070be28665bf180449bec8775aa97e93788- SHA1
e46836dc1581e17f4905a6bfe6a5792d4f879366- MD5
44d3d806763f8836080a957da9abc004- Filename
- 552.12.zip
- File type
- zip
- MIME
- application/zip
- File size
- 140633121
- TLSH
T12868E0603696C522C4AE013915AE2F3FE6687C20035557E3EAD8373D2FB7AE4593EB11- SSDEEP
1572864:81/UgPT6e3lYKcTPGxSCmUiFcCMTQCfnYaDtfW/2xKAlh0IFPhhEZVvMHA521:p+f4FcCMTPYEjKAlh0IFPwVvMHA521
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Analysis signals
OBSERVEDEngine detections4%
Relationship context15 visible
Threat classificationtrojan
Intelligence freshnessHistorical
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
html
169030 bytes
drops
Filename
PrivacyPolicy_sk-SK.htm
File type
html
MIME
text/html
Size
169030
SHA1
c49c6474b9c5c394851195de162da2dae3840c82
0%
html
169409 bytes
drops
Filename
PrivacyPolicy_de-DE.htm
File type
html
MIME
text/html
Size
169409
SHA1
e93e4b1630953f1af1c96ef6c603ac248d85cc20
0%
html
187143 bytes
contains
Filename
PrivacyPolicy_uk-UA.htm
File type
html
MIME
text/html
Size
187143
SHA1
d0bebbd2edea77c199307c0aad922be084872f01
0%
text
659 bytes
drops
Filename
FunctionalConsent_it-IT.txt
File type
text
MIME
text/plain
Size
659
SHA1
add49bf8d254594bc4bbb61a071bb874c4d5f877
0%
html
171020 bytes
drops
Filename
PrivacyPolicy_hu-HU.htm
File type
html
MIME
text/html
Size
171020
SHA1
43dec79ccfd55eb11481b02fb69f76ee5e1eac07
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
104.76.208.0/20
Network
104.76.210.0-104.76.210.255
First seen
2023-09-30T19:26:18Z
Last seen
2026-11-10T06:54:02Z
0%
US
communicates
CIDR
13.107.252.0/23
Network
13.64.0.0-13.107.255.255
First seen
2023-10-01T03:10:24Z
Last seen
2026-11-10T15:50:56Z
11%
medium
SA
communicates
Network
89.35.237.0-89.35.237.255
First seen
2024-02-12T10:47:28Z
Last seen
2026-11-05T01:46:07Z
0%
US
communicates
CIDR
104.76.210.0/23
Network
104.76.210.0-104.76.210.255
First seen
2023-09-30T00:56:32Z
Last seen
2026-11-10T06:54:02Z
0%
US
communicates
CIDR
13.107.4.0/22
Network
13.64.0.0-13.107.255.255
First seen
2023-10-01T11:20:43Z
Last seen
2026-11-10T10:03:42Z
Related domains
Domains associated with this indicator.
5shown
0%
.cn
communicates
Root
nvidia.cn
TLD
cn
Subdomain
images
First seen
2026-08-05T14:12:52Z
Last seen
2026-08-05T14:12:52Z
0%
.com
communicates
Root
nvidia.com
TLD
com
Subdomain
images
First seen
2023-09-29T07:29:58Z
Last seen
2026-11-04T14:34:43Z
5%
low
.net
communicates
Root
azureedge.net
TLD
net
Subdomain
edge-consumer-static
First seen
2023-10-29T04:39:06Z
Last seen
2026-11-10T16:31:31Z
0%
.net
communicates
Root
azureedge.net
TLD
net
Subdomain
edge-mobile-static
First seen
2023-09-30T16:35:46Z
Last seen
2026-11-10T16:31:31Z
0%
.net
communicates
Root
nelreports.net
TLD
net
Subdomain
bzib
First seen
2023-09-29T22:17:36Z
Last seen
2026-11-10T06:54:03Z
Analysis details
Severity: hightrojanzipembedded-executableprocess-renamedebug-checkinput-checkexec-delaycryptoself-delete
Freshness: Historical · Last seen 874 days ago.
- Detection rate
- 4%
- Threat type
- trojan
- detection
- 4 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
9bd8e89f2a6c285e0772a237b1cc0070be28665bf180449bec8775aa97e93788- SHA1
e46836dc1581e17f4905a6bfe6a5792d4f879366- MD5
44d3d806763f8836080a957da9abc004- Filename
- 552.12.zip
- File type
- zip
- MIME
- application/zip
- File size
- 140633121
- TLSH
T12868E0603696C522C4AE013915AE2F3FE6687C20035557E3EAD8373D2FB7AE4593EB11- SSDEEP
1572864:81/UgPT6e3lYKcTPGxSCmUiFcCMTQCfnYaDtfW/2xKAlh0IFPhhEZVvMHA521:p+f4FcCMTPYEjKAlh0IFPwVvMHA521- First seen
- 2024-06-14T23:04:45Z
- Last seen
- 2024-06-19T10:06:22Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2023-01-21 to 2026-08-05. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan.
Last seen 874 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 552.12.zip
- File type
- zip
- MIME
- application/zip
- Size
- 140633121
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Allocates memory with a write watch (potentially for evading sandboxes)
- At least one IP Address, Domain, or File Name was found in a crypto call
- Attempts to create or modify system certificates
- Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
- Binary contains paths to debug symbols
5 shown
View MITRE ATT&CK details · 5 shown
- T1057 — Adversaries may attempt to get information about running processes on a system.Tactics: TA0007
- T1564 — Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.Tactics: TA0005
- T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.Tactics: TA0011
- T1070 — Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.Tactics: TA0005
- T1497 — Adversaries may employ various means to detect and avoid virtualization and analysis environments.Tactics: TA0005 · TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- C0008 — Change Memory ProtectionObjectives: OC0002
- B0009.005 — Check Registry KeysObjectives: OB0001
- Command and ControlObjectives: OB0004
- CommunicationObjectives: OC0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5
TCPports 443, 80
- 5 outbound connections observed
- 0 domains, 5 IPs, 0 URLs
- Common ports: 443, 80
- Protocols: TCP
View details · 5 shown
- IP
- 89.35.237.180
- Port
- 80
- Protocol
- TCP
- IP
- 204.79.197.203
- Port
- 443
- Protocol
- TCP
- IP
- 13.107.6.158
- Port
- 443
- Protocol
- TCP
- IP
- 13.107.253.41
- Port
- 443
- Protocol
- TCP
- IP
- 104.76.210.87
- Port
- 443
- Protocol
- TCP
DNS request activity4
A4 response IPs
- 4 DNS requests observed
- 4 unique queries
- 4 response IPs
- Query types: A
- Response codes: NOERROR
View details · 4 shown
- Query
- edge-consumer-static.azureedge.net
- Query
- edge-mobile-static.azureedge.net
- Type
- A
- Answers
- 13.107.253.41
- Response
- NOERROR
- Query
- bzib.nelreports.net
- Type
- A
- Answers
- 104.76.210.87, 104.76.210.75
- Response
- NOERROR
- Query
- business.bing.com
- Type
- A
- Answers
- 13.107.6.158
- Response
- NOERROR