Report - a8d5ab7b66f5…4dc23a66b0

No detections FILE

Quota 36

First seen: 2024-07-24T16:59:41Z
Last seen: 2025-02-06T13:26:17Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS16Connections in this report

ANALYSISNo detectionsHistorical

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: a8d5ab7b66f55a9f71e5de4d3bda29435aa7a52bfe88a4266e1bab4dc23a66b0
SHA1: 48d220f85e51d0d2c6334f896266257371ebf669
MD5: 1cf58352cb02d6084ed9c7ed52ce7ad6
Filename: a8d5ab7b_stellarrepairforexcel-b.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 8514368
Compile time: 2023-02-15T14:54:16Z
PE platform: x86 32-bit
PE sections: 10

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context16 visible

Intelligence freshnessHistorical

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

835f1a0f4c68c261e41344aa4f728da6ea573678e61de0c352d73ab0c0cb7f33

4% medium zip 15824602 bytes contains

Filename 835f1a0f_stellar repair for excel 7.0.0.1 [filecr].zip.bin Type pua File type zip MIME application/zip Size 15824602

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

17032f7b6fb619a87a1b078617550e5e55c1b80ed4a1597804e7d28c63e9b69d

0% html 599 bytes drops

Filename 17032f7b_170.bin File type html MIME text/html Size 599 SHA1 eec329464c9cb9421c9ce4b67fadec74cf02937b

71f76548b10974c46b69063dc7ee9d3c19dd3fec408c7720deb00c9fcbdcc0a7

0% pedll 237936 bytes drops

Filename 71f76548_is-ju3sd.tmp.bin File type pedll MIME application/vnd.microsoft.portable-executable Size 237936 Compile time 2002-04-23T18:10:22Z

726b8c3feee5c6bf5c2966e090f7e6b0c9097cc307398df437bed25e6fc15998

0% text 72 bytes contains

Filename 726b8c3f_[0].bin File type text MIME text/plain Size 72 SHA1 a90cb54e1d7c11fe06ffc55c05a332bd3bd43396

75bb01fe4bafdef22d879aaea5b85d1165a30ec0e558536e1b4c6002c4730d5d

0% xml 1960 bytes contains

Filename 75bb01fe_1_1.bin File type xml MIME application/xml Size 1960 SHA1 593953973c74066bcd09b22402948425dab9b12f

e3c87716559caa8d132753a9644a6645de391c1f4161c2c087d89979bf35bab8

0% csv 226 bytes drops

Filename e3c87716_csc.exe.log.bin File type csv MIME text/plain Size 226 SHA1 56a983e2347529fbe3033a48f589cad7e9ff3635

Related IPs

Network IPs associated with this indicator.

5shown

173.194.79.94

0% US communicates

CIDR 173.194.0.0/16 Network 173.194.0.0-173.194.255.255 First seen 2023-09-28T17:11:14Z Last seen 2026-11-15T07:01:04Z

13.107.42.14

0% US communicates

CIDR 13.107.42.0/23 Network 13.64.0.0-13.107.255.255 First seen 2023-09-29T03:46:20Z Last seen 2026-11-14T11:36:47Z

192.168.0.36

0% communicates

First seen 2022-12-08T06:41:44Z Last seen 2026-11-15T08:10:14Z

104.71.214.69

0% US communicates

CIDR 104.71.192.0/19 Network 104.71.212.0-104.71.215.255 First seen 2023-10-15T14:20:44Z Last seen 2026-11-15T08:13:16Z

192.168.0.43

0% communicates

First seen 2022-11-25T04:46:04Z Last seen 2026-11-15T08:12:48Z

Related domains

Domains associated with this indicator.

5shown

css.zohocdn.com

0% .com communicates

Root zohocdn.com TLD com Subdomain css First seen 2023-09-29T11:05:28Z Last seen 2026-11-13T16:05:32Z

www.clarity.ms

0% .ms communicates

Root clarity.ms TLD ms Subdomain www First seen 2023-09-29T02:22:05Z Last seen 2026-11-15T07:10:00Z

c.clarity.ms

0% .ms communicates

Root clarity.ms TLD ms Subdomain c First seen 2023-09-30T19:02:06Z Last seen 2026-11-15T05:06:31Z

ajax.googleapis.com

5% high .com communicates

Root googleapis.com TLD com Subdomain ajax First seen 2023-09-30T14:31:07Z Last seen 2026-11-15T07:52:49Z

chidc2.outbrain.org

0% .org communicates

Root outbrain.org TLD org Subdomain chidc2 First seen 2023-09-30T10:17:44Z Last seen 2026-11-13T21:36:40Z

Analysis details

exeinput-checkexec-delaydebug-checkfile-overlaysigned

Freshness: Historical · Last seen 646 days ago.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: a8d5ab7b66f55a9f71e5de4d3bda29435aa7a52bfe88a4266e1bab4dc23a66b0
SHA1: 48d220f85e51d0d2c6334f896266257371ebf669
MD5: 1cf58352cb02d6084ed9c7ed52ce7ad6
Filename: a8d5ab7b_stellarrepairforexcel-b.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 8514368
Compile time: 2023-02-15T14:54:16Z
PE platform: x86 32-bit
PE sections: 10
Import libraries: 7
TLSH: T13486122BE254632ED5EB7A3236B3C62845376F616C1A8C1E0FEC34FDCB714602D2A655
SSDEEP: 196608:2vCLywuPAVxEGx72WMQfSbK0vPhvjdcLt958TYVjvjP:WWuUJ2WpfRCRY6grr
Imphash: e569e6f445d32ba23766ad67d1e3787f
First seen: 2024-07-24T16:59:41Z
Last seen: 2025-02-06T13:26:17Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2002-04-23 to 2024-08-03. These are observation or metadata times, not execution order.

Infrastructure geography

3 infrastructure/location point(s) are visible on the map.

Intelligence freshness

Last seen 646 days ago. Revalidate volatile infrastructure before enforcement.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Historical

Last seen 646 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: a8d5ab7b_stellarrepairforexcel-b.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 8514368
Compile time: 2023-02-15T14:54:16Z
PE platform: x86 32-bit
Entry point: 745196
Sections: 10

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

input-checkdebug-checkexec-delay

View details · 5 shown

Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains paths to debug symbols
Classification label
Clickable URLs found in PDF
Connects to IPs without corresponding DNS lookups

5 shown

View MITRE ATT&CK details · 5 shown

T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Tactics: TA0011
T1129 — Adversaries may execute malicious payloads via loading shared modules.
Tactics: TA0002
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007
T1566.002 — Clickable URLs found in PDF
Tactics: TA0001
T1056 — Creates a DirectInput object (often for capturing keystrokes)
Tactics: TA0006 · TA0009

5 shown

View MBC details · 5 shown

C0007 — Allocate Memory
Objectives: OC0002
C0032.001 — CRC32
Objectives: OC0004
E1059 — Command and Scripting Interpreter
Objectives: OB0009
Communication
Objectives: OC0006
C0046 — Create Directory
Objectives: OC0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDPports 443, 80, 137

5+ outbound connections observed
0 domains, 5+ IPs, 0 URLs
Common ports: 443, 80, 137, 1900
Protocols: TCP, UDP

View details · 5 shown

IP: 239.255.255.250
Port: 1900
Protocol: UDP

IP: 89.36.170.147
Port: 443
Protocol: TCP

IP: 84.17.46.53
Port: 443
Protocol: TCP

IP: 84.17.46.49
Port: 443
Protocol: TCP

IP: 74.125.143.95
Port: 443
Protocol: TCP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: ajax.googleapis.com
Type: A
Answers: 108.177.119.95
Response: NOERROR

Query: zpublic.zohopublic.com
Type: A
Answers: 136.143.182.97
Response: NOERROR

Query: www.stellarinfo.com
Type: A
Answers: 15.197.254.101, 3.33.191.88
Response: NOERROR

Query: www.microsoft.com
Type: A
Answers: 23.216.81.152, 104.71.214.69
Response: NOERROR

Query: www.microsoft.com
Type: A
Answers: 104.71.214.69
Response: NOERROR

5 shown

C2 candidates1

UDPports 1900

1 C2 candidate communications
0 domains, 1 IPs
Common ports: 1900
Protocols: UDP

View details · 1 shown

IP: 239.255.255.250
Port: 1900
Protocol: UDP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 2023-02-15T14:54:16Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 745196
Sections: 10
Compile time: 2023-02-15T14:54:16Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: rw, r, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 735716
Raw size: 735744
Permissions: rx
Entropy: 6.36

Name: .itext
Virtual address: 741376
Virtual size: 5768
Raw size: 6144
Permissions: rx
Entropy: 5.97

Name: .data
Virtual address: 749568
Virtual size: 14244
Raw size: 14336
Permissions: rw
Entropy: 5.05

Name: .bss
Virtual address: 765952
Virtual size: 28136
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .idata
Virtual address: 794624
Virtual size: 4060
Raw size: 4096
Permissions: rw
Entropy: 5.03

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: kernel32.dll
Functions: CloseHandle, CompareStringW, CreateDirectoryW, CreateEventW, CreateFileW, CreateProcessW, CreateThread, DeleteCriticalSection …

Library: comctl32.dll
Functions: InitCommonControls

Library: version.dll
Functions: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Library: user32.dll
Functions: CallWindowProcW, CharLowerBuffW, CharNextW, CharUpperBuffW, CharUpperW, CreateWindowExW, DestroyWindow, DispatchMessageW …

Library: oleaut32.dll
Functions: SafeArrayCreate, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SysAllocStringLen, SysFreeString, SysReAllocStringLen, VariantChangeType …

5 shown

Exports3

3 exported items

3 exported items

View details · 3 shown

Name: TMethodImplementationIntercept

Name: __dbk_fcall_wrapper

Name: dbkFCallWrapperAddr

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_MANIFEST

View details · 5 shown

Type: RT_ICON
Language: ENGLISH US

Type: RT_STRING
Language: NEUTRAL

Type: RT_RCDATA
Language: NEUTRAL

Type: RT_GROUP_ICON
Language: ENGLISH US

Type: RT_VERSION
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

4 issuers

Example subject: Stellar Information Technology Private Limited
Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Validity period (UTC): 2022-05-23 – 2025-04-12

View details · 5 shown

Subject: Stellar Information Technology Private Limited
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Valid from: 1653264000.0
Valid to: 1744502340.0
Fingerprint: CBDD73B7B7C27DE9E7ED76771C777D5F0A646A76

Subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issuer: DigiCert Trusted Root G4
Valid from: 1619654400.0
Valid to: 2093039940.0
Fingerprint: 7B0F360B775F76C94A12CA48445AA2D2A875701C

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Valid from: 1659312000.0
Valid to: 1952035140.0
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert
Issuer: DigiCert Assured ID Root CA
Valid from: 1163116800.0
Valid to: 1952035200.0
Fingerprint: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

Subject: DigiCert Timestamp 2023
Issuer: DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
Fingerprint: 66F02B32C2C2C90F825DCEAA8AC9C64F199CCF40

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check