- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEVirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
- SHA256
a73ffdbece6caba7e6c1862103fae3d9d8507d656733d225c2679dce05ca2b8c- SHA1
53c6b417063dfc25acf7b3cfb28fd3cc7b213254- MD5
148bcda81becd122c6291e1b8780dcbe- Filename
- a73ffdbe_fdbece6caba7e6c1862103fae3d9d8507d656733d225c2679dce05ca2b8c.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 7000568
- Compile time
- 2011-02-09T12:43:39Z
- PE platform
- x86 32-bit
- PE sections
- 8
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
High-confidence evidence. Related indicators in this report: 18. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (29%).
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections29%
VirusSign confidence100%
Relationship context18 visible
Threat classificationlinkular
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
58%
high
peexe
710848 bytes
drops
Filename
eb8e59dd_light image resize.exe.bin
Family
installcore
Type
pua
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
ico
318 bytes
contains
Filename
6e80d06c_4.ico.bin
File type
ico
MIME
application/octet-stream
Size
318
SHA1
7801cbb8d8286e32f81e4c1e63ee198c2ccf8f46
0%
ico
1406 bytes
contains
Filename
90c2217b_13.ico.bin
File type
ico
MIME
application/octet-stream
Size
1406
SHA1
a122e0940efa2561e9ac329c3d6c70f658b08853
0%
ico
2238 bytes
contains
Filename
d59f7243_5.ico.bin
File type
ico
MIME
application/octet-stream
Size
2238
SHA1
d792c68f1d43af7d291a8afe9e52ec33caef7b7d
0%
xml
1376 bytes
contains
Filename
ec233469_8d7accca43bc3864983dbbb9af490005.bin
File type
xml
MIME
application/xml
Size
1376
SHA1
07ae72350bcbfedb5015a78efd74fcfd3bab11ac
0%
82944 bytes
contains
Filename
233ed987_file-2173986_text.bin
MIME
application/octet-stream
Size
82944
SHA1
386995a1ffa7ac746880a639064ca65486965ae2
First seen
2011-04-21T18:26:30Z
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
64.4.0.0/18
Network
64.4.0.0-64.4.63.255
First seen
2023-10-12T12:28:21Z
Last seen
2026-11-14T18:46:25Z
0%
US
communicates
CIDR
104.16.0.0/14
Network
104.16.0.0-104.31.255.255
First seen
2023-10-11T23:17:27Z
Last seen
2026-11-15T04:33:13Z
0%
US
communicates
CIDR
104.16.0.0/14
Network
104.16.0.0-104.31.255.255
First seen
2023-10-06T06:07:03Z
Last seen
2026-11-15T04:28:59Z
0%
US
communicates
CIDR
13.107.192.0/19
Network
13.64.0.0-13.107.255.255
First seen
2023-09-30T12:22:03Z
Last seen
2026-11-15T03:44:40Z
0%
US
communicates
CIDR
74.125.0.0/16
Network
74.125.0.0-74.125.255.255
First seen
2023-09-29T20:32:54Z
Last seen
2026-11-15T04:07:43Z
Related domains
Domains associated with this indicator.
5shown
5%
low
.com
communicates
Root
googlesyndication.com
TLD
com
Subdomain
pagead2
First seen
2023-10-01T10:19:17Z
Last seen
2026-11-15T04:32:23Z
0%
.com
communicates
Root
cloudflare.com
TLD
com
Subdomain
a.nel
First seen
2023-09-29T06:06:10Z
Last seen
2026-11-15T02:56:25Z
0%
.com
communicates
Root
gvt1.com
TLD
com
Subdomain
edgedl.me
First seen
2023-09-30T04:07:43Z
Last seen
2026-11-15T04:31:49Z
0%
.com
communicates
Root
cloudflareinsights.com
TLD
com
Subdomain
static
First seen
2019-09-01T12:42:43Z
Last seen
2026-11-15T04:25:31Z
5%
high
.com
communicates
Root
googleapis.com
TLD
com
Subdomain
storage
First seen
2023-09-28T17:11:14Z
Last seen
2026-11-15T04:32:53Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
TLD
com
HTTP status
200
Content SHA256
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
First seen
2015-01-09T03:43:16Z
Last seen
2026-05-03T09:48:27Z
0%
communicates
TLD
com
HTTP status
200
Content length
44712
Content SHA256
48684cf7dcd13a75b096f1b1eaae05aab1c20863ba2e3d09eb5740f30daf3eec
First seen
2017-08-12T21:59:43Z
Analysis details
Severity: highadwarefile-overlaycpu-clockinvalid-signaturedebug-checkexedynamic-loadinginput-checkexec-delaycryptoobfuscatedsigned
Freshness: Aging · Last seen 37 days ago.
- Detection rate
- 29%
- Threat type
- adware
- Family
- linkular
- Confidence
- 100%
- confidence
- 100 · VirusSign confidence; engine detections are reported separately.
Overview
- SHA256
a73ffdbece6caba7e6c1862103fae3d9d8507d656733d225c2679dce05ca2b8c- SHA1
53c6b417063dfc25acf7b3cfb28fd3cc7b213254- MD5
148bcda81becd122c6291e1b8780dcbe- Filename
- a73ffdbe_fdbece6caba7e6c1862103fae3d9d8507d656733d225c2679dce05ca2b8c.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 7000568
- Compile time
- 2011-02-09T12:43:39Z
- PE platform
- x86 32-bit
- PE sections
- 8
- Import libraries
- 5
- TLSH
T136663306F3838432DEA97879CC4948501D26F6B42DE290150FFEFB4C5D7AAD2D8B7866- SSDEEP
196608:T7tj+/1c3Q50kpr/cyeoeUSEnrGu3xvI+:Htj6WW0kp/oonSBSI+- Imphash
483f0c4259a9148c34961abbda6146c1- First seen
- 2014-01-21T22:37:18Z
- Last seen
- 2026-10-09T00:26:23Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
High-confidence evidence. Related indicators in this report: 18. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (29%).
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type adware and family linkular.
Relationship context
18 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
19 timestamped observations are arranged from 1992-06-19 to 2023-10-12. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
5 relationship group(s) provide pivot and infrastructure context.
Classification context: type adware, family linkular.
Last seen 37 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- a73ffdbe_fdbece6caba7e6c1862103fae3d9d8507d656733d225c2679dce05ca2b8c.bin
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 7000568
- Compile time
- 2011-02-09T12:43:39Z
- PE platform
- x86 32-bit
- Entry point
- 91256
- Sections
- 8
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A file was accessed within the Public folder.
- Anomalous file deletion behavior detected (10+)
- Attempts to connect to a dead IP:Port
- Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
- Binary contains paths to debug symbols
5 shown
View MITRE ATT&CK details · 5 shown
- T1036 · T1548 — A file was accessed within the Public folder.Tactics: TA0004 · TA0005
- T1485 — Anomalous file deletion behavior detected (10+)Tactics: TA0040
- T1071 — Attempts to connect to a dead IP:PortTactics: TA0011
- T1027.002 — Binary may include packed or crypted dataTactics: TA0005
- T1082 — Checks available memoryTactics: TA0007
5 shown
View MBC details · 5 shown
- C0007 — Allocate MemoryObjectives: OC0002
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- E1010 — Application Window DiscoveryObjectives: OB0007
- F0013 — BootkitObjectives: OB0006 · OB0012
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, UDP, HTTPports 443, 80, 123
- 5+ outbound connections observed
- 2 domains, 5+ IPs, 2 URLs
- Common ports: 443, 80, 123, 1900
- Protocols: TCP, UDP, HTTP
View details · 5 shown
- IP
- 239.255.255.250
- Port
- 1900
- Protocol
- UDP
- Domain
- www.obviousidea.com
- URL
- http://www.obviousidea.com/windows-software/light-image-resizer/how-to-resize-a-photo/?from=linkularsetup
- Protocol
- HTTP
- Domain
- support.obviousidea.com
- URL
- http://support.obviousidea.com/generateevent.php?cat=lightimageresizer&act=setup_addon&lbl=yes&val=1&lng=en&sig=4716845aeda52ad485c85dc0b1728b5f
- Protocol
- HTTP
- IP
- 74.125.9.8
- Port
- 443
- Protocol
- TCP
- IP
- 74.125.9.8
- Port
- 443
- Protocol
- UDP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- storage.googleapis.com
- Query
- pagead2.googlesyndication.com
- Type
- A
- Answers
- 209.85.145.157, 209.85.145.156, 209.85.145.155, 209.85.145.154
- Response
- NOERROR
- Query
- edge-consumer-static.azureedge.net
- Query
- clients2.googleusercontent.com
- Type
- A
- Answers
- 192.178.212.132
- Response
- NOERROR
- Query
- yt3.ggpht.com
- Type
- A
- Answers
- 142.251.183.132, 192.178.129.132, 142.251.189.132, 209.85.145.132, 74.125.201.132, 173.194.206.132, 64.233.179.132, 172.217.214.132 …
- Response
- NOERROR
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit5+ sections
- Platform: x86 32-bit
- Sections: 5+
- Entry point: present
- Compile time: 2011-02-09T12:43:39Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 91256
- Sections
- 8
- Compile time
- 2011-02-09T12:43:39Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: rw, r, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 82928
- Raw size
- 82944
- Permissions
- rx
- Entropy
- 6.48
- Name
- .itext
- Virtual address
- 90112
- Virtual size
- 3048
- Raw size
- 3072
- Permissions
- rx
- Entropy
- 6.01
- Name
- .data
- Virtual address
- 94208
- Virtual size
- 3484
- Raw size
- 3584
- Permissions
- rw
- Entropy
- 2.68
- Name
- .bss
- Virtual address
- 98304
- Virtual size
- 22288
- Raw size
- 0
- Permissions
- rw
- Entropy
- 0.0
- Name
- .idata
- Virtual address
- 122880
- Virtual size
- 3998
- Raw size
- 4096
- Permissions
- rw
- Entropy
- 4.97
5 shown
Imports5
5 DLL groups
- 5 import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- oleaut32.dll
- Functions
- SafeArrayCreate, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SysAllocStringLen, SysFreeString, SysReAllocStringLen, VariantChangeType …
- Library
- advapi32.dll
- Functions
- AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegCloseKey, RegOpenKeyExW, RegQueryValueExW
- Library
- user32.dll
- Functions
- CallWindowProcW, CharNextW, CharUpperBuffW, CreateWindowExW, DestroyWindow, DispatchMessageW, ExitWindowsEx, GetKeyboardType …
- Library
- kernel32.dll
- Functions
- CloseHandle, CompareStringW, CreateDirectoryW, CreateEventW, CreateFileW, CreateProcessW, DeleteCriticalSection, DeleteFileW …
- Library
- comctl32.dll
- Functions
- InitCommonControls
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_STRING, RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_MANIFEST
View details · 5 shown
- Type
- RT_ICON
- Language
- DUTCH
- Type
- RT_STRING
- Language
- NEUTRAL
- Type
- RT_RCDATA
- Language
- ENGLISH US
- Type
- RT_RCDATA
- Language
- NEUTRAL
- Type
- RT_GROUP_ICON
- Language
- ENGLISH US
5 shown
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5
4 issuers
- Example subject: ObviousIdea
- Issued by: Thawte Code Signing CA - G2
- Validity period (UTC): 2013-01-11 – 2015-02-14
View details · 5 shown
- Subject
- ObviousIdea
- Issuer
- Thawte Code Signing CA - G2
- Valid from
- 1357862400.0
- Valid to
- 1423958340.0
- Fingerprint
- 17699B145104C3C21205AC4F2945638746BC8963
- Subject
- Thawte Code Signing CA - G2
- Issuer
- thawte Primary Root CA
- Valid from
- 1265587200.0
- Valid to
- 1581119940.0
- Fingerprint
- 808D62642B7D1C4A9A83FD667F7A2A9D243FB1C7
- Subject
- thawte
- Issuer
- thawte Primary Root CA
- Valid from
- 1163721600.0
- Valid to
- 2099865540.0
- Fingerprint
- 91C6D6EE3E8AC86384E548C299295C756C817B81
- Subject
- Symantec Time Stamping Services CA - G2
- Issuer
- Thawte Timestamping CA
- Fingerprint
- 6C07453FFDDA08B83707C09B82FB3D15F35336B1
- Subject
- Symantec Time Stamping Services Signer - G4
- Issuer
- Symantec Time Stamping Services CA - G2
- Fingerprint
- 65439929B67973EB192D6FF243E6767ADF0834E4