- First seen
- Last seen
THREAT SIGNALLow
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
b04a55038fcda34a3d374193ad32c05cc69c6ddba6a40b2ff4efdb704f187198- SHA1
ef193686c683c208ee358c9b28275d9446b1d1e7- MD5
8fd4cd48b7a0aaaa9f5a9258c9c6393b- Filename
- Game Inspector Analyser.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1598464
- Compile time
- 2018-03-11T22:03:29Z
- PE platform
- x86 32-bit
- PE sections
- 3
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Analysis signals
OBSERVEDEngine detections4%
Relationship context11 visible
Threat classificationtrojan
Intelligence freshnessHistorical
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related IPs
Network IPs associated with this indicator.
4shown
11%
high
US
communicates
CIDR
209.197.0.0/19
Network
209.197.0.0-209.197.31.255
First seen
2023-09-30T21:27:37Z
Last seen
2026-11-13T03:12:18Z
0%
US
communicates
CIDR
23.195.80.0/20
Network
23.192.0.0-23.223.255.255
First seen
2023-09-29T16:34:21Z
Last seen
2026-11-13T04:10:31Z
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2023-09-29T22:00:59Z
Last seen
2026-11-13T03:32:30Z
0%
US
communicates
CIDR
20.64.0.0/10
Network
20.33.0.0-20.128.255.255
First seen
2023-09-29T18:30:08Z
Last seen
2026-11-13T03:32:30Z
Related domains
Domains associated with this indicator.
2shown
0%
.com
communicates
Root
microsoft.com
TLD
com
First seen
2026-01-29T18:48:34Z
Last seen
2026-11-13T04:11:55Z
0%
.com
communicates
Root
microsoft.com
TLD
com
Subdomain
crl
First seen
2023-09-30T22:38:44Z
Last seen
2026-11-13T04:11:55Z
Related URLs
URLs associated with this indicator.
5shown
10%
critical
communicates
First seen
2014-12-31T05:40:05Z
Last seen
2026-10-07T15:43:17Z
0%
communicates
HTTP status
400
Content length
207
Content SHA256
dbc2a256f64b942230d70ee857dfa3f76d99ad1188c20a2d3d32bda020aa7710
First seen
2022-11-17T22:46:12Z
Last seen
2026-06-30T21:18:06Z
0%
communicates
TLD
com
HTTP status
200
Content length
767
Content SHA256
50795b027e2bc566d3b7acb89913f8efd23b70615c9db9bf5b23323ad3132a7d
First seen
2011-10-22T01:16:18Z
0%
communicates
TLD
com
HTTP status
200
Content length
519
Content SHA256
b19f80a5970542f71e1728cdeee5d4534598329ba22fabf5bbd2280ebd6ba629
First seen
2012-06-22T07:35:22Z
0%
communicates
TLD
com
HTTP status
200
Content length
530
Content SHA256
3b9b2f75b724fe5354d24a0ef729b8a2aaa8a9313166eafb1f73b07cf1a745ef
First seen
2011-04-19T20:21:18Z
Analysis details
Severity: hightrojanexedotnetdynamic-loadingdebug-checkcpu-clockinput-checksigned
Freshness: Historical · Last seen 694 days ago.
- Detection rate
- 4%
- Threat type
- trojan
- detection
- 4 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
b04a55038fcda34a3d374193ad32c05cc69c6ddba6a40b2ff4efdb704f187198- SHA1
ef193686c683c208ee358c9b28275d9446b1d1e7- MD5
8fd4cd48b7a0aaaa9f5a9258c9c6393b- Filename
- Game Inspector Analyser.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 1598464
- Compile time
- 2018-03-11T22:03:29Z
- PE platform
- x86 32-bit
- PE sections
- 3
- Import libraries
- 1
- TLSH
T1E875E71032B8C616C56E76F56860C17042B5BD826A52E74A39F17F9F3CB3B83DD421AE- SSDEEP
12288:a2cUaqqhQUd9/Y4jfCSpsf2SxWzJO9IGS6ce:Wm4djJsvxWzWb- Imphash
f34d5f2d4577ed6d9ceec516c1f5a744- First seen
- 2022-12-28T11:04:56Z
- Last seen
- 2024-12-18T13:44:07Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Threat context
Classification includes type trojan.
Relationship context
11 related indicators are shown across 3 relationship group(s).
Observation timeline
12 timestamped observations are arranged from 2011-04-19 to 2026-01-29. These are observation or metadata times, not execution order.
Infrastructure geography
4 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan.
Last seen 694 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- Game Inspector Analyser.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 1598464
- Compile time
- 2018-03-11T22:03:29Z
- PE platform
- x86 32-bit
- Entry point
- 1233318
- Sections
- 3
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- access .NET resource
- check if directory exists
- check if file exists
- compiled to the .NET platform
- contains PDB path
5 shown
View MITRE ATT&CK details · 5 shown
- T1027.002 — .NET source code contains potential unpackerTactics: TA0005
- T1056 — Creates a DirectInput object (often for capturing keystrokes)Tactics: TA0006 · TA0009
- T1562.001 — Creates guard pages, often used to prevent reverse engineering and debuggingTactics: TA0005
- T1012 — Monitors certain registry keys / values for changes (often done to protect autostart functionality)Tactics: TA0007
- T1124 — Potential time zone aware malwareTactics: TA0007
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 443, 80
- 5+ outbound connections observed
- 3 domains, 4 IPs, 5 URLs
- Common ports: 443, 80
- Protocols: HTTP, TCP
View details · 5 shown
- Domain
- 209.197.3.8
- URL
- http://209.197.3.8/
- Protocol
- HTTP
- IP
- 209.197.3.8
- Port
- 80
- Protocol
- TCP
- Domain
- crl.microsoft.com
- URL
- http://crl.microsoft.com/pki/crl/products/winpca.crl
- Protocol
- HTTP
- Domain
- crl.microsoft.com
- URL
- http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl
- Protocol
- HTTP
- Domain
- crl.microsoft.com
- URL
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
- Protocol
- HTTP
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit3 sections
- Platform: x86 32-bit
- Sections: 3
- Entry point: present
- Compile time: 2018-03-11T22:03:29Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 1233318
- Sections
- 3
- Compile time
- 2018-03-11T22:03:29Z
PE sections3
3 sections
- 3 PE sections
- Common permissions: r, rx
- 3 unique section names
View details · 3 shown
- Name
- .text
- Virtual address
- 8192
- Virtual size
- 1225132
- Raw size
- 1225216
- Permissions
- rx
- Entropy
- 5.14
- Name
- .rsrc
- Virtual address
- 1236992
- Virtual size
- 372000
- Raw size
- 372224
- Permissions
- r
- Entropy
- 1.71
- Name
- .reloc
- Virtual address
- 1613824
- Virtual size
- 12
- Raw size
- 512
- Permissions
- r
- Entropy
- 0.1
Imports1
1 DLL groups
- 1 import DLL groups
- 1 imported functions summarized
View details · 1 shown
- Library
- mscoree.dll
- Functions
- _CorExeMain
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION
View details · 4 shown
- Type
- RT_ICON
- Language
- NEUTRAL
- Type
- RT_GROUP_ICON
- Language
- NEUTRAL
- Type
- RT_VERSION
- Language
- NEUTRAL
- Type
- RT_MANIFEST
- Language
- NEUTRAL
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates5+
5+ issuers
- Example subject: Microsoft Corporation
- Issued by: Microsoft Code Signing PCA
View details · 5 shown
- Subject
- Microsoft Corporation
- Issuer
- Microsoft Code Signing PCA
- Fingerprint
- AC1FD0922A4A2A6E5779ACDD628747C28394B0B9
- Subject
- Microsoft Time-Stamp Service
- Issuer
- Microsoft Time-Stamp PCA
- Fingerprint
- AB68EE3B381D989F4EA15419E7D5960D0010D858
- Subject
- Microsoft Code Signing PCA
- Issuer
- Microsoft Root Certificate Authority
- Fingerprint
- 3CAF9BA2DB5570CAF76942FF99101B993888E257
- Subject
- Microsoft Time-Stamp PCA
- Issuer
- Microsoft Root Certificate Authority
- Fingerprint
- 375FCB825C3DC3752A02E34EB70993B4997191EF
- Subject
- Microsoft Corporation
- Issuer
- Microsoft Code Signing PCA 2011
- Fingerprint
- BCA0A72FBF7C3A6666CBB15EEB450A3AE6F14A48
5 shown