- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
a6b2a3131669d745ce097d784a1e227b0e80cb246ea364ef9301cf7887ef1d8c- SHA1
0f71a9a19d65280751376d5c6d5c05681e8fb628- MD5
d9cce325c03d67363466fe82850dcbc9- Filename
- a6b2a313_<sample.exe>.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 492032
- Compile time
- 2021-08-27T20:48:49Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 79%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections79%
VirusSign confidence100%
Relationship context17 visible
Threat classificationseraph
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
79%
critical
peexe
492032 bytes
drops
Filename
a6b2a313_<sample.exe>.bin
Family
seraph
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
158974 bytes
drops
Filename
6c78ef77_tar8269.tmp.bin
MIME
model/stl
Size
158974
SHA1
d5ca0025fbd356deb8ede35001f93039625562a5
First seen
2021-06-22T01:12:00Z
0%
cab
61020 bytes
drops
Filename
e6a7f1f8_cabac38.tmp.bin
File type
cab
MIME
application/vnd.ms-cab-compressed
Size
61020
SHA1
5d11d14a2558801a2688dc2d6dfad39ac294f222
0%
140227 bytes
drops
Filename
f520a87f_tared5b.tmp.bin
MIME
model/stl
Size
140227
SHA1
822b5b8cb9169c358c6bc2c92466d439c983cd87
First seen
2019-05-02T00:27:07Z
0%
cab
57523 bytes
drops
Filename
a45a77d2_cab3858.tmp.bin
File type
cab
MIME
application/vnd.ms-cab-compressed
Size
57523
SHA1
73a69b3ce43bf74d60af94c251d7cca64b206a44
0%
crt
1521 bytes
drops
Filename
df545bf9_manifestcountersignrootcertificate.cer.bin
File type
crt
MIME
application/pkix-cert
Size
1521
SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5
Related IPs
Network IPs associated with this indicator.
4shown
GB
communicates
CIDR
37.0.8.0/24
First seen
2026-04-25T03:43:52Z
Last seen
2026-04-25T22:34:00Z
5%
low
CN
communicates
CIDR
210.192.116.0/22
Network
210.192.96.0-210.192.127.255
First seen
2025-06-08T22:00:47Z
Last seen
2026-10-18T13:00:17Z
0%
US
communicates
Network
93.184.220.0-93.184.223.255
First seen
2023-09-30T04:59:19Z
Last seen
2026-11-13T11:50:46Z
0%
US
communicates
CIDR
131.107.0.0/16
Network
131.107.0.0-131.107.255.255
First seen
2023-09-30T20:19:39Z
Last seen
2026-11-14T00:18:43Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
msftncsi.com
TLD
com
Subdomain
dns
First seen
2023-09-30T20:19:39Z
Last seen
2026-11-14T00:18:43Z
0%
.com
communicates
Root
windowsupdate.com
TLD
com
Subdomain
www.download
First seen
2023-09-30T18:30:00Z
Last seen
2026-11-13T17:18:51Z
0%
.com
communicates
Root
windowsupdate.com
TLD
com
Subdomain
download
First seen
2023-09-28T22:12:25Z
Last seen
2026-11-14T03:55:38Z
0%
.com
communicates
Root
windowsupdate.com
TLD
com
First seen
2023-09-30T06:34:16Z
Last seen
2026-11-14T04:01:04Z
0%
.com
communicates
Root
windowsupdate.com
TLD
com
Subdomain
ctldl
First seen
2023-09-28T19:20:58Z
Last seen
2026-11-14T04:09:14Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
TLD
com
HTTP status
200
Content length
61020
Content SHA256
e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544
First seen
2021-08-30T20:37:25Z
0%
communicates
TLD
com
HTTP status
200
Content length
73211
Content SHA256
33ba8221ff3f5211b6b08004d7a48fb4ccfbef8450715cfbfa299cc1b617d7a0
First seen
2010-06-18T02:47:30Z
Analysis details
Severity: criticaltrojanmalwaredotnetdynamic-loadingexedebug-checkpolymorphiccpu-clockexeccve-2014-3931exploitrat
Freshness: Historical · Last seen 215 days ago.
- Detection rate
- 79%
- Threat type
- trojan
- Family
- seraph
- Confidence
- 100%
- detection
- 79 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
a6b2a3131669d745ce097d784a1e227b0e80cb246ea364ef9301cf7887ef1d8c- SHA1
0f71a9a19d65280751376d5c6d5c05681e8fb628- MD5
d9cce325c03d67363466fe82850dcbc9- Filename
- a6b2a313_<sample.exe>.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 492032
- Compile time
- 2021-08-27T20:48:49Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 1
- TLSH
T160A415909EEFDEDEC26F623FA04A5C9205DEC3064757A2E58F464E31B3842279C561E3- SSDEEP
12288:7HKmGHcjHd6/FthMnPsYF8WyaAvS7wXF29ITXDwT2U:zKRHcA/rKrdyLXgQsT2U- Imphash
f34d5f2d4577ed6d9ceec516c1f5a744- First seen
- 2021-08-29T03:34:37Z
- Last seen
- 2026-04-12T20:30:53Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 79%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family seraph.
Relationship context
17 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
17 timestamped observations are arranged from 2010-06-18 to 2026-04-25. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
5 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family seraph.
Last seen 215 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- a6b2a313_<sample.exe>.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 492032
- Compile time
- 2021-08-27T20:48:49Z
- PE platform
- x86 32-bit
- Entry point
- 361502
- Sections
- 3
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- access .NET resource
- compiled to the .NET platform
- load .NET assembly
- manipulate console buffer
- reference analysis tools strings
5 shown
View MITRE ATT&CK details · 1 shown
- T1620 — load .NET assemblyTactics: TA0005
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 80, 161
- 5+ outbound connections observed
- 2 domains, 3 IPs, 2 URLs
- Common ports: 80, 161
- Protocols: HTTP, TCP
View details · 5 shown
- IP
- 210.192.117.42
- Port
- 80
- Protocol
- TCP
- Domain
- www.download.windowsupdate.com
- URL
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- Protocol
- HTTP
- Domain
- ctldl.windowsupdate.com
- URL
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?abb5ec44ca1b05a0
- Protocol
- HTTP
- IP
- 93.184.221.240
- Port
- 80
- Protocol
- TCP
- IP
- 37.0.8.220
- Port
- 161
- Protocol
- TCP
DNS request activity1
A1 response IPs
- 1 DNS requests observed
- 1 unique queries
- 1 response IPs
- Query types: A
- Response codes: NOERROR
View details · 1 shown
- Query
- dns.msftncsi.com
- Type
- A
- Answers
- 131.107.255.255
- Response
- NOERROR
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2021-08-27T20:48:49Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 361502
- Sections
- 3
- Compile time
- 2021-08-27T20:48:49Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: r, rx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 8192
- Virtual size
- 353316
- Raw size
- 353792
- Permissions
- rx
- Entropy
- 7.95
- Name
- .rsrc
- Virtual address
- 368640
- Virtual size
- 137116
- Raw size
- 137216
- Permissions
- r
- Entropy
- 4.67
- Name
- .reloc
- Virtual address
- 507904
- Virtual size
- 12
- Raw size
- 512
- Permissions
- r
- Entropy
- 0.1
Imports1
1 DLL groups
- 1 import DLL groups
- 1 imported functions summarized
View details · 1 shown
- Library
- mscoree.dll
- Functions
- _CorExeMain
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION
View details · 4 shown
- Type
- RT_ICON
- Language
- NEUTRAL
- Type
- RT_GROUP_ICON
- Language
- NEUTRAL
- Type
- RT_VERSION
- Language
- NEUTRAL
- Type
- RT_MANIFEST
- Language
- NEUTRAL