- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
b70473a69006c247c74cd4df0a247ebfb8963e09a286eda5bc593b6fd29f4531- SHA1
f67abadb06272d59ac43bf80615c8b39bd27fc55- MD5
65951165603152db9256fe6a9485a64b- Filename
- s.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 684032
- Compile time
- 2026-11-06T03:57:58Z
- PE platform
- x86 32-bit
- PE sections
- 4
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 5. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 65%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections65%
VirusSign confidence100%
Relationship context5 visible
Threat classificationmidie
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
12 bytes
contains
Filename
c01d4cd5bb1b57b835a1c2fba8e21e69
MIME
application/octet-stream
Size
12
SHA1
be4bef44f1fce0552bee077b50211ebc04a5a777
First seen
2014-03-16T20:38:57Z
0%
java-bytecode
226 bytes
contains
Filename
mfc80CHS_30721_2_5.bin
File type
java-bytecode
MIME
application/java-vm
Size
226
SHA1
5299e0b15c862d118bed43251fd6ebde8d9f824d
0%
178 bytes
contains
Filename
5228e05f53b7eee70cdae8bfe4e116b7
MIME
application/octet-stream
Size
178
SHA1
59952cfa6cf756626c57c641c85f752ea8997d80
First seen
2013-02-19T23:22:59Z
0%
308 bytes
contains
Filename
240
MIME
application/octet-stream
Size
308
SHA1
ac9f852776d2a94c6676a83d55b52d8ae4f6e75f
First seen
2013-02-24T14:55:23Z
0%
308 bytes
contains
Filename
5
MIME
application/octet-stream
Size
308
SHA1
2f48a547a1427833013f1ccc5d3119ab36c1cb11
First seen
2013-02-20T11:05:56Z
Analysis details
Severity: hightrojanexeobfuscatedpolymorphic
Freshness: Fresh · Last seen 1 day ago.
- Detection rate
- 65%
- Threat type
- trojan
- Family
- midie
- Confidence
- 100%
- detection
- 65 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
b70473a69006c247c74cd4df0a247ebfb8963e09a286eda5bc593b6fd29f4531- SHA1
f67abadb06272d59ac43bf80615c8b39bd27fc55- MD5
65951165603152db9256fe6a9485a64b- Filename
- s.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 684032
- Compile time
- 2026-11-06T03:57:58Z
- PE platform
- x86 32-bit
- PE sections
- 4
- Import libraries
- 12
- TLSH
T116E48D06F6D240F6C765593029AE67369A395E160F19CFC3A354FE1819331E1AE3B23E- SSDEEP
6144:Tm8olhYmnLJfn34P+9+1Zf03Dsdft+Kdbmn3uNUZvPc6+sAj7PJJCutDKgw8qP/Y:S8QYmnLJP342kBdan+Wi3/J0Dgw8qPg- Imphash
f79c68cbec1310bb086ac2744ee5beb6- Richhash
fe8cbeb0a7f6cfa0c6f779239d52d703- First seen
- 2026-11-07T05:02:27Z
- Last seen
- 2026-11-10T00:21:20Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 5. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 65%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family midie.
Relationship context
5 related indicators are shown across 1 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
6 timestamped observations are arranged from 2013-02-17 to 2026-11-06. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
1 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family midie.
Last seen 1 day ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- s.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 684032
- Compile time
- 2026-11-06T03:57:58Z
- PE platform
- x86 32-bit
- Entry point
- 379717
- Sections
- 4
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- Authenticode signature is invalid
- Checks system language via registry key (possible geofencing)
- Classification label
- Disables application error messsages (SetErrorMode)
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1036 · T1553.002 — Authenticode signature is invalidTactics: TA0005 · TA0112
- T1027 — The PE entry point is located unusually far into its section, indicative of an appended packer stubTactics: TA0005
- T1071 — Unconventionial binary language: Chinese (Simplified)Tactics: TA0011
- T1129 — access PEB ldr_dataTactics: TA0002
5 shown
View MBC details · 5 shown
- E1010 — Application Window DiscoveryObjectives: OB0007
- B0032.020 — Argument ObfuscationObjectives: OB0002
- E1510 — Clipboard ModificationObjectives: OB0008
- CommunicationObjectives: OC0006
- C0060 — Compression LibraryObjectives: OC0004
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit4 sections
- Platform: x86 32-bit
- Sections: 4
- Entry point: present
- Compile time: 2026-11-06T03:57:58Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 379717
- Sections
- 4
- Compile time
- 2026-11-06T03:57:58Z
PE sections4
4 sections
- 4 PE sections
- Common permissions: r, rw, rx
- 4 unique section names
View details · 4 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 501502
- Raw size
- 503808
- Permissions
- rx
- Entropy
- 6.57
- Name
- .rdata
- Virtual address
- 507904
- Virtual size
- 77354
- Raw size
- 77824
- Permissions
- r
- Entropy
- 4.59
- Name
- .data
- Virtual address
- 585728
- Virtual size
- 137672
- Raw size
- 73728
- Permissions
- rw
- Entropy
- 5.08
- Name
- .rsrc
- Virtual address
- 724992
- Virtual size
- 23108
- Raw size
- 24576
- Permissions
- r
- Entropy
- 4.84
Imports5+
5+ DLL groups
- 5+ import DLL groups
- 5+ imported functions summarized
View details · 5 shown
- Library
- KERNEL32.dll
- Functions
- CloseHandle, CompareStringA, CompareStringW, CreateEventA, CreateFileA, CreateSemaphoreA, CreateThread, DeleteCriticalSection …
- Library
- USER32.dll
- Functions
- AdjustWindowRectEx, AppendMenuA, BeginPaint, CallNextHookEx, CallWindowProcA, CharUpperA, CheckMenuItem, ChildWindowFromPointEx …
- Library
- GDI32.dll
- Functions
- BeginPath, BitBlt, CombineRgn, CreateBitmap, CreateCompatibleBitmap, CreateCompatibleDC, CreateDCA, CreateDIBitmap …
- Library
- WINMM.dll
- Functions
- midiOutPrepareHeader, midiOutReset, midiOutUnprepareHeader, midiStreamClose, midiStreamOpen, midiStreamOut, midiStreamProperty, midiStreamRestart …
- Library
- WINSPOOL.DRV
- Functions
- ClosePrinter, DocumentPropertiesA, OpenPrinterA
5 shown
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_BITMAP, RT_STRING, RT_DIALOG, RT_ICON, RT_CURSOR
View details · 5 shown
- Type
- TEXTINCLUDE
- Language
- CHINESE SIMPLIFIED
- Type
- RT_CURSOR
- Language
- CHINESE SIMPLIFIED
- Type
- RT_BITMAP
- Language
- CHINESE SIMPLIFIED
- Type
- RT_ICON
- Language
- CHINESE SIMPLIFIED
- Type
- RT_ICON
- Language
- NEUTRAL
5 shown