- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
a065e3e1e86ecae8ddb33d37a2ca4c9469bbb9e65bcebbbdc15519ebf2180782- SHA1
8ab37d5efb55d890a77ca3699ebc28f52ca1218e- MD5
e20e8279a267bc039ab9b86fe90a8b7c- Filename
- a065e3e1_%d1%80%d0%b5%d0%ba%d0%bb%d0%b0%d0%bc%d0%b0%d1%86%d0%b8%d1%8f.docx.bin
- File type
- docx
- MIME
- application/octet-stream
- File size
- 17558
- TLSH
T14072B065DC617CB1E271113491B209C3FF8DD2179272A0CE11A27ACCBEA69F74B156CE- SSDEEP
384:+7v/sYehmVh2SB9AFU2+grsZoD0YeQEosRqwIPgb67m9ySmdV9:evimf2tFU2+lZoD9eQEbqwI37mw19
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections10%
VirusSign confidence76%
Relationship context18 visible
Threat classificationremotetemplateinj
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
xml
4251 bytes
contains
Filename
fe39b9b2_document.xml.bin
File type
xml
MIME
application/xml
Size
4251
SHA1
d3db7cb54c0ebaca55298a33d3e25766a1469fca
5%
critical
xml
346 bytes
contains
Filename
98a3f8a0_settings.xml.rels.bin
Family
equmby
Type
trojan
File type
xml
MIME
application/xml
0%
lnk
1036 bytes
drops
Filename
b0ff678d_readme.docx.lnk.bin
File type
lnk
MIME
application/x-ms-shortcut
Size
1036
SHA1
0d0e08097059d448660e0e68524a08cc8da4865c
60%
critical
rtf
786925 bytes
drops
Filename
5c3f003c_jfgsdjcnjskdcasdkfnasdfg.bin
Family
obfsstrm
Type
exploit
File type
rtf
MIME
application/octet-stream
0%
xml
14806 bytes
contains
Filename
05c04887_numbering.xml.bin
File type
xml
MIME
application/xml
Size
14806
SHA1
d3f7c9fb7dba72fd3aad8941552d0b7cec3f157d
Related IPs
Network IPs associated with this indicator.
5shown
0%
GB
communicates
CIDR
51.132.0.0/16
Network
51.132.128.0-51.132.255.255
First seen
2026-09-14T11:06:13Z
Last seen
2026-11-13T17:19:25Z
5%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2026-08-16T09:11:17Z
Last seen
2026-11-14T01:45:16Z
5%
low
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2024-08-25T00:41:09Z
Last seen
2026-11-14T01:43:51Z
0%
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2026-05-06T05:25:22Z
Last seen
2026-11-14T01:40:42Z
0%
US
communicates
CIDR
150.171.64.0/18
Network
150.171.0.0-150.171.255.255
First seen
2026-05-09T14:25:56Z
Last seen
2026-11-14T01:01:29Z
Related domains
Domains associated with this indicator.
5shown
0%
.ru
communicates
Root
mosconst.ru
TLD
ru
First seen
2023-11-02T19:30:30Z
Last seen
2026-11-13T17:19:25Z
0%
.microsoft
communicates
Root
cloud.microsoft
TLD
microsoft
Subdomain
atm.office.mira.tm.svc
First seen
2024-08-26T16:41:58Z
Last seen
2026-11-14T01:15:45Z
24%
high
.ru
communicates
Root
valisi.ru
TLD
ru
First seen
2025-03-20T14:28:52Z
Last seen
2026-11-13T17:19:26Z
0%
.com
communicates
Root
live.com
TLD
com
Subdomain
roaming.officeapps
First seen
2023-09-29T05:53:28Z
Last seen
2026-11-14T01:38:13Z
0%
.net
communicates
Root
office.net
TLD
net
Subdomain
uci.cdn
First seen
2023-09-30T19:52:13Z
Last seen
2026-11-14T00:32:10Z
Related URLs
URLs associated with this indicator.
3shown
0%
communicates
TLD
ru
HTTP status
403
Content length
9497
Content SHA256
25c872b509361978e9fa41f0c5264c55d83f88ee27adc44a0c1ad351d8956ff9
First seen
2026-11-13T01:26:59Z
24%
high
communicates
TLD
ru
HTTP status
200
Content length
786925
Content SHA256
5c3f003cc7a6a16c1d7e03f196aa2852d05af18f69e6935680cbaa3c22c4bd23
First seen
2026-11-13T01:01:18Z
29%
high
communicates
TLD
ru
HTTP status
200
Content length
17413
Content SHA256
fe10398d6c23a1475cffe0094f8615c6d961ac5bc6c2f5e60d53911cecb357c1
First seen
2018-01-25T04:28:45Z
Analysis details
Severity: criticaltrojancve-2017-0199exploitdocxobfuscatedcryptowmi-activity
Freshness: Fresh · Last seen today.
- Detection rate
- 10%
- Threat type
- trojan
- Family
- remotetemplateinj
- Confidence
- 76%
- detection
- 10 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
a065e3e1e86ecae8ddb33d37a2ca4c9469bbb9e65bcebbbdc15519ebf2180782- SHA1
8ab37d5efb55d890a77ca3699ebc28f52ca1218e- MD5
e20e8279a267bc039ab9b86fe90a8b7c- Filename
- a065e3e1_%d1%80%d0%b5%d0%ba%d0%bb%d0%b0%d0%bc%d0%b0%d1%86%d0%b8%d1%8f.docx.bin
- File type
- docx
- MIME
- application/octet-stream
- File size
- 17558
- TLSH
T14072B065DC617CB1E271113491B209C3FF8DD2179272A0CE11A27ACCBEA69F74B156CE- SSDEEP
384:+7v/sYehmVh2SB9AFU2+grsZoD0YeQEosRqwIPgb67m9ySmdV9:evimf2tFU2+lZoD9eQEbqwI37mw19- First seen
- 2026-11-12T20:10:50Z
- Last seen
- 2026-11-13T17:19:20Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (10%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type trojan and family remotetemplateinj.
Relationship context
18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
19 timestamped observations are arranged from 2018-01-25 to 2026-11-13. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family remotetemplateinj.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- a065e3e1_%d1%80%d0%b5%d0%ba%d0%bb%d0%b0%d0%bc%d0%b0%d1%86%d0%b8%d1%8f.docx.bin
- File type
- docx
- MIME
- application/octet-stream
- Size
- 17558
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A HTTP/S link was seen in a script or command line
- A document file initiated network communications indicative of a potential exploit or payload download
- A document or script file initiated network communications indicative of a potential exploit or payload download
- A script process initiated network activity
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1059 · T1071 — A HTTP/S link was seen in a script or command lineTactics: TA0002 · TA0011
- T1071 · T1221 — A document file initiated network communications indicative of a potential exploit or payload downloadTactics: TA0005 · TA0011
- T1059 · T1064 · T1071 — A script process initiated network activityTactics: TA0002 · TA0005 · TA0011
- T1071 — Accesses the UserInfo registry key, potentially used for discoveryTactics: TA0011
5 shown
View MBC details · 5 shown
- B0030 — C2 CommunicationObjectives: OB0004
- Command and ControlObjectives: OB0004
- E1059 — Command and Scripting InterpreterObjectives: OB0009
- CommunicationObjectives: OC0006
- CryptographyObjectives: OC0005
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 443, 80
- 5+ outbound connections observed
- 2 domains, 5+ IPs, 4 URLs
- Common ports: 443, 80
- Protocols: HTTP, TCP
View details · 5 shown
- Domain
- valisi.ru
- URL
- http://valisi.ru/jfgsdjcnjskdcasdkfnasdfg
- Protocol
- HTTP
- Domain
- valisi.ru
- URL
- http://valisi.ru/
- Protocol
- HTTP
- Domain
- valisi.ru
- URL
- http://valisi.ru
- Protocol
- HTTP
- IP
- 91.218.228.26
- Port
- 80
- Protocol
- TCP
- IP
- 150.171.109.152
- Port
- 443
- Protocol
- TCP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- valisi.ru
- Type
- A
- Answers
- 91.218.228.26
- Response
- NOERROR
- Query
- metadata.templates.cdn.office.net
- Type
- A
- Answers
- 23.212.62.204, 23.212.62.217
- Response
- NOERROR
- Query
- uci.cdn.office.net
- Type
- A
- Answers
- 23.46.228.76, 23.46.228.74
- Response
- NOERROR
- Query
- roaming.officeapps.live.com
- Type
- A
- Answers
- 52.110.16.21, 52.110.16.36, 52.110.16.7, 52.110.16.30
- Response
- NOERROR
- Query
- nexusrules.officeapps.live.com
- Type
- A
- Answers
- 150.171.109.76, 150.171.110.9, 150.171.109.71, 150.171.110.148, 150.171.110.3, 150.171.109.67, 150.171.109.146, 150.171.110.211 …
- Response
- NOERROR
5 shown
C2 candidates2
DNS, HTTPports 53
- 2 C2 candidate communications
- 1 domains, 1 IPs
- Common ports: 53
- Protocols: DNS, HTTP
View details · 2 shown
- Domain
- valisi.ru
- Protocol
- HTTP
- IP
- 91.218.228.26
- Domain
- valisi.ru
- Port
- 53
- Protocol
- DNS