Report - bafe0636fcd4…0a9e689ec5

Malicious HighFILE

Quota 40

First seen: 2026-08-29T04:57:58Z
Last seen: 2026-09-17T02:17:15Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYoffercoreadware

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousAging

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: bafe0636fcd490d86a90bdb3d8ab40e41c285b2647e07033edfad50a9e689ec5
SHA1: dc0848188c7381f567ed2e4171cfe6d4ac5d03ed
MD5: 5d76f63234f35a99d32b04143d102cc0
Filename: bafe0636_x37xd.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 5475816
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
PE sections: 11

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 43%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections43%

VirusSign confidence100%

Relationship context20 visible

Threat classificationoffercore

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

dcbab07aa57abc62b3c90ba58cbaa0bfb77d0bbed023203f4f00702a69eba9ec

5% medium peexe 4461056 bytes drops

Filename dcbab07a_executable.tmp.bin Family offercore Type pua File type peexe MIME application/vnd.microsoft.portable-executable

f6b86339ea9e79135202d66903e14a64c88b3d9ba3f0c7a6cb124412d44e637b

0% 73728 bytes contains

Filename f6b86339_.reloc.bin MIME application/octet-stream Size 73728 SHA1 e97b93417956f4e6813d6d419b8a2856b357509b First seen 2026-04-17T06:37:07Z

a01c87dd7c465d0284faabb9f3e7446455e686aed92b7cc650b069f745fdf5e9

0% 6656 bytes contains

Filename a01c87dd_.itext.bin MIME application/octet-stream Size 6656 SHA1 af6a5c7a136572f0a4266cf3901ed9b2d717383a First seen 2026-04-17T06:44:13Z

4d485808295e129e85b6546e0a8973619f9bee700c6b60671d7ecd71b55843cc

0% 719360 bytes contains

Filename 4d485808_.text.bin MIME application/octet-stream Size 719360 SHA1 0e58a8e84b1ccf14bea1848aad3276a06e9114a4 First seen 2026-04-17T06:48:10Z

f8bc31927074957901bc7975eec99aa54e759a66cbe2ca8bbbb16a2705caeedc

0% 512 bytes contains

Filename f8bc3192_.rdata.bin MIME application/octet-stream Size 512 SHA1 08fb7c36e037736171d75dff700936dd50e1e966 First seen 2026-04-17T06:33:38Z

Related IPs

Network IPs associated with this indicator.

5shown

23.46.216.138

0% US communicates

CIDR 23.46.216.0/23 Network 23.32.0.0-23.67.255.255 First seen 2025-04-22T01:15:03Z Last seen 2026-11-14T14:30:23Z

23.46.216.132

0% US communicates

CIDR 23.46.216.0/23 Network 23.32.0.0-23.67.255.255 First seen 2025-04-23T07:47:17Z Last seen 2026-11-15T00:02:19Z

18.172.170.87

0% US communicates

CIDR 18.172.168.0/21 Network 18.172.0.0-18.173.255.255 First seen 2023-10-01T19:58:52Z Last seen 2026-11-14T16:34:17Z

3.165.160.80

0% US communicates

CIDR 3.128.0.0/10 Network 3.165.0.0-3.165.255.255 First seen 2024-08-31T16:26:39Z Last seen 2026-11-14T07:08:57Z

3.165.160.66

0% US communicates

CIDR 3.128.0.0/10 Network 3.165.0.0-3.165.255.255 First seen 2024-09-01T08:06:26Z Last seen 2026-11-14T17:15:56Z

Related domains

Domains associated with this indicator.

5shown

uupdate.avast.com

0% .com communicates

Root avast.com TLD com Subdomain uupdate First seen 2023-09-29T15:06:11Z Last seen 2026-11-15T04:03:27Z

ncc.avast.com

0% .com communicates

Root avast.com TLD com Subdomain ncc First seen 2023-09-29T15:58:18Z Last seen 2026-11-15T04:03:25Z

avast.com

0% .com communicates

Root avast.com TLD com First seen 2023-09-29T15:04:20Z Last seen 2026-11-15T04:03:18Z

branding.avast.com

0% .com communicates

Root avast.com TLD com Subdomain branding First seen 2023-10-10T02:08:30Z Last seen 2026-11-15T04:03:22Z

dl5.filehippo.com

0% .com communicates

Root filehippo.com TLD com Subdomain dl5 First seen 2023-09-30T11:31:11Z Last seen 2026-11-15T02:19:20Z

Related URLs

URLs associated with this indicator.

5shown

http://ncc.avast.com/ncc.txt

0% communicates

TLD com HTTP status 200 Content length 26 Content SHA256 837def894a069786ff70e524b6b9cc16a7d745954c20f4623b6e6783150e5d37 First seen 2016-11-12T21:46:29Z

http://emupdate.avcdn.net/files/emupdate/updates.xml

0% communicates

TLD net HTTP status 200 Content length 115691 Content SHA256 a6abcf6cc22359b4ee8596bd231ff42aa8212aa7156ee4619a927f943a43d951 First seen 2017-03-08T22:12:26Z

http://emupdate.avcdn.net/files/emupdate/autoupdate.ini

0% communicates

TLD net HTTP status 200 Content length 2 Content SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6 First seen 2018-08-26T00:34:42Z

http://uupdate.avast.com/files/emupdate/avast_antitrack_494.cab

0% communicates

TLD com HTTP status 200 Content length 695 Content SHA256 f2d3072a159b79d49dfb43b01b63601ff7f2b628e24f0a1ee397ae3e34a0617d First seen 2020-03-19T02:26:32Z

http://uupdate.avast.com/files/emupdate/avast_probe_gen.xml

0% communicates

TLD com HTTP status 200 Content length 69591 Content SHA256 ac2b45e3664db47a9b30f45c508355562de21e15af2b3d34f2d4fe2da993fbab First seen 2023-09-10T21:24:50Z

Analysis details

Severity: highadwareexefile-overlayobfuscatedself-deletesigned

Freshness: Aging · Last seen 59 days ago.

Detection rate: 43%
Threat type: adware
Family: offercore
Confidence: 100%
detection: 43 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: bafe0636fcd490d86a90bdb3d8ab40e41c285b2647e07033edfad50a9e689ec5
SHA1: dc0848188c7381f567ed2e4171cfe6d4ac5d03ed
MD5: 5d76f63234f35a99d32b04143d102cc0
Filename: bafe0636_x37xd.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 5475816
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
PE sections: 11
Import libraries: 5
TLSH: T18246023BA18BE53EE07A5A353972A11058FB7F6D65124C069AE4F44CCF360B01D3E6B6
SSDEEP: 98304:O5OqM3rURINHAa2JiCdJ9YKzoFOqQtAwKLoa2rj42A44D5kmH:y/MbURXNYKzogqQtAwKLD2H42r4jH
Imphash: 88016fcdef7f227c62171d0afad9aae4
First seen: 2026-08-29T04:57:58Z
Last seen: 2026-09-17T02:17:15Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 43%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type adware and family offercore.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2016-11-12 to 2026-04-17. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 43%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification offercore

Classification context: type adware, family offercore.

Intelligence freshness Aging

Last seen 59 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: bafe0636_x37xd.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 5475816
Compile time: 2026-02-11T11:40:27Z
PE platform: x86 32-bit
Entry point: 728672
Sections: 11

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscatedself-delete

View details · 5 shown

A DLL was loaded from a suspicious directory
A file was accessed within the Public folder.
Checks available memory
Checks for mouse movement
Checks system language via registry key (possible geofencing)

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1036 · T1548 — A file was accessed within the Public folder.
Tactics: TA0004 · TA0005
T1082 — Checks available memory
Tactics: TA0007
T1497 — Checks for mouse movement
Tactics: TA0005 · TA0007
T1055 — Contains .tls (Thread Local Storage) section
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Communication
Objectives: OC0006
B0002 — Debugger Evasion
Objectives: OB0001
Defense Evasion
Objectives: OB0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, HTTP, UDPports 443, 80, 53

5+ outbound connections observed
3 domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 53, 5353, 5355
Protocols: TCP, HTTP, UDP

View details · 5 shown

IP: 224.0.0.252
Port: 5355
Protocol: UDP

Domain: uupdate.avast.com
URL: http://uupdate.avast.com/files/emupdate/overseer-wave2-317.cab
Protocol: HTTP

Domain: uupdate.avast.com
URL: http://uupdate.avast.com/files/emupdate/avast_probe_gen.xml
Protocol: HTTP

Domain: uupdate.avast.com
URL: http://uupdate.avast.com/files/emupdate/avast_antitrack_494.cab
Protocol: HTTP

Domain: ncc.avast.com
URL: http://ncc.avast.com/ncc.txt
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: shepherd.avcdn.net
Type: A
Answers: 34.160.176.28
Response: NOERROR

Query: honzik.avcdn.net
Type: A
Answers: 23.216.147.144, 23.216.147.132, 23.216.147.131
Response: NOERROR

Query: api.reasonsecurity.com
Type: A
Answers: 172.66.146.164, 104.20.36.249
Response: NOERROR

Query: uupdate.avast.com
Type: A
Answers: 23.46.216.142, 23.46.216.132
Response: NOERROR

Query: update.reasonsecurity.com
Type: A
Answers: 3.165.160.66, 3.165.160.26, 3.165.160.11, 3.165.160.112
Response: NOERROR

5 shown

C2 candidates2

TCP, UDPports 5355, 7500

2 C2 candidate communications
0 domains, 2 IPs
Common ports: 5355, 7500
Protocols: TCP, UDP

View details · 2 shown

IP: 34.74.148.245
Port: 7500
Protocol: TCP

IP: 224.0.0.252
Port: 5355
Protocol: UDP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 2026-02-11T11:40:27Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 728672
Sections: 11
Compile time: 2026-02-11T11:40:27Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: rw, r, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 718860
Raw size: 719360
Permissions: rx
Entropy: 6.38

Name: .itext
Virtual address: 724992
Virtual size: 6348
Raw size: 6656
Permissions: rx
Entropy: 6.04

Name: .data
Virtual address: 733184
Virtual size: 16188
Raw size: 16384
Permissions: rw
Entropy: 5.18

Name: .bss
Virtual address: 749568
Virtual size: 29516
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .idata
Virtual address: 782336
Virtual size: 4200
Raw size: 4608
Permissions: rw
Entropy: 4.82

5 shown

Imports5

5 DLL groups

5 import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: kernel32.dll
Functions: CloseHandle, CompareStringOrdinal, CompareStringW, CreateDirectoryW, CreateEventW, CreateFileW, CreateProcessW, CreateThread …

Library: comctl32.dll
Functions: InitCommonControls

Library: user32.dll
Functions: CallWindowProcW, CharLowerBuffW, CharNextW, CharUpperBuffW, CharUpperW, CreateWindowExW, DestroyWindow, DispatchMessageW …

Library: oleaut32.dll
Functions: SafeArrayAccessData, SafeArrayCreate, SafeArrayGetElement, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayUnaccessData …

Library: advapi32.dll
Functions: AdjustTokenPrivileges, AllocateAndInitializeSid, ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, EqualSid, FreeSid, GetTokenInformation, LookupPrivilegeValueW …

Exports2

2 exported items

2 exported items

View details · 2 shown

Name: __dbk_fcall_wrapper

Name: dbkFCallWrapperAddr

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_MANIFEST

View details · 5 shown

Type: RT_ICON
Language: ENGLISH US

Type: RT_STRING
Language: NEUTRAL

Type: RT_RCDATA
Language: NEUTRAL

Type: RT_RCDATA
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5+ issuers

Example subject: KOPETRA LTD
Issued by: Sectigo Public Code Signing CA EV R36
Validity period (UTC): 2026-01-27 – 2027-01-27

View details · 5 shown

Subject: KOPETRA LTD
Issuer: Sectigo Public Code Signing CA EV R36
Valid from: 1769472000.0
Valid to: 1801094340.0
Fingerprint: 397BAB93570DA8EBB85D8E1017C9FB8249025A0C

Subject: Sectigo Public Code Signing CA EV R36
Issuer: Sectigo Public Code Signing Root R46
Valid from: 1616371200.0
Valid to: 2089756740.0
Fingerprint: 0185FF9961FF0AA2E431817948C28E83D3F3EC70

Subject: Sectigo Public Code Signing Root R46
Issuer: AAA Certificate Services
Valid from: 1621900800.0
Valid to: 1861919940.0
Fingerprint: 329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692

Subject: Sectigo (AAA)
Issuer: AAA Certificate Services
Valid from: 1072915200.0
Valid to: 1861919940.0
Fingerprint: D1EB23A46D17D68FD92564C2F1F1601764D8E349

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check