- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
bc9af6e9e4ab8ccecf79ddf4be39184aca5311da6437bd2acacf39b77e43fc1d- SHA1
2a82948083de3b884d96d70f2259054bca6d5e63- MD5
719a39f6fa65e40d6091e0d2c7f33af2- Filename
- NELCO LIMITED_SKM_C590368369060_417161.pdf
- File type
- MIME
- application/octet-stream
- File size
- 78703
- Filename variants
- 3 reported
- TLSH
T17E730128F8816CDCFA071A0B5939760803AFB3B372CA64D5DCADCE51C484D66DD675A3- SSDEEP
1536:wJiXa72Gq5YtU1UTeX1YTlmEkn0eFeDqu2490VrkJ6ElEJJzwopynK8i7i2:rq7AYtZZlmLndG24OVrC6/Bs7i7b
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections9%
VirusSign confidence76%
Relationship context16 visible
Threat classificationphishingx
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
1shown
19%
high
outlook
198656 bytes
contains
Filename
Fwd_ _NELCO LIMITED_ AFCI_CPGBrokers_July 02_ 2024_2024_Distribution__Notice_992703_Final_pdf with you - Copy.msg
Family
phishingx
Type
phishing
File type
outlook
MIME
application/octet-stream
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
json
285 bytes
drops
Filename
DC_READER_LAUNCH_CARD
File type
json
MIME
application/json
Size
285
SHA1
9c41f22aa2e3918250bb0cd2ca506409d2536a54
0%
json
767 bytes
drops
Filename
SOPHIA.json
File type
json
MIME
application/json
Size
767
SHA1
c89530092cde7acb74d72ebe95767507868020ae
0%
text
19098 bytes
drops
Filename
NGLClient_AcrobatReader123.8.20533.6.log
File type
text
MIME
text/plain
Size
19098
SHA1
9e2a33a7ed2b654c6660effe0d8ae32413c7ec33
0%
json
1395 bytes
drops
Filename
DC_Reader_RHP_Banner
File type
json
MIME
application/json
Size
1395
SHA1
d4d59651e7f3aad7e35ec94f70756aff8719b793
0%
json
782 bytes
drops
Filename
Edit_InApp_Aug2020
File type
json
MIME
application/json
Size
782
SHA1
14e1f815c27d2a29bed8dbf924578acd7ede7c6e
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
66.102.0.0/20
Network
66.102.0.0-66.102.15.255
First seen
2023-10-17T05:38:52Z
Last seen
2026-11-11T21:49:28Z
0%
US
communicates
CIDR
104.16.0.0/14
Network
104.16.0.0-104.31.255.255
First seen
2026-07-25T08:36:09Z
Last seen
2026-11-04T07:46:22Z
0%
US
communicates
CIDR
104.16.0.0/14
Network
104.16.0.0-104.31.255.255
First seen
2023-09-29T13:38:17Z
Last seen
2026-11-04T07:46:22Z
0%
US
communicates
CIDR
35.184.0.0/13
Network
35.184.0.0-35.191.255.255
First seen
2023-09-29T20:18:47Z
Last seen
2026-11-13T01:03:07Z
0%
US
communicates
CIDR
54.144.0.0/14
Network
54.144.0.0-54.147.255.255
First seen
2023-10-01T00:33:28Z
Last seen
2026-11-12T22:13:35Z
Related domains
Domains associated with this indicator.
5shown
14%
high
.ru
communicates
Root
com.ru
TLD
ru
Subdomain
glanmire
First seen
2025-06-26T11:08:18Z
Last seen
2026-01-29T13:05:48Z
0%
.com
communicates
Root
bing.com
TLD
com
Subdomain
r.g
First seen
2019-01-06T02:35:03Z
Last seen
2026-10-01T10:54:18Z
0%
.com
communicates
Root
adobe.com
TLD
com
Subdomain
acrobat
First seen
2023-09-30T19:02:06Z
Last seen
2026-11-09T13:08:58Z
0%
.com
communicates
Root
adobe.com
TLD
com
Subdomain
www
First seen
2023-10-01T09:10:26Z
Last seen
2026-11-13T00:07:28Z
0%
.com
communicates
Root
cloudflare.com
TLD
com
Subdomain
challenges
First seen
2023-09-29T13:38:17Z
Last seen
2026-11-13T00:35:04Z
Analysis details
Severity: highphishingpdfinput-checkadapter-discoveryattachment
Freshness: Historical · Last seen 861 days ago.
- Detection rate
- 9%
- Threat type
- phishing
- Family
- phishingx
- Confidence
- 76%
- detection
- 9 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
bc9af6e9e4ab8ccecf79ddf4be39184aca5311da6437bd2acacf39b77e43fc1d- SHA1
2a82948083de3b884d96d70f2259054bca6d5e63- MD5
719a39f6fa65e40d6091e0d2c7f33af2- Filename
- NELCO LIMITED_SKM_C590368369060_417161.pdf
- File type
- MIME
- application/octet-stream
- File size
- 78703
- TLSH
T17E730128F8816CDCFA071A0B5939760803AFB3B372CA64D5DCADCE51C484D66DD675A3- SSDEEP
1536:wJiXa72Gq5YtU1UTeX1YTlmEkn0eFeDqu2490VrkJ6ElEJJzwopynK8i7i2:rq7AYtZZlmLndG24OVrC6/Bs7i7b- First seen
- 2024-06-29T16:13:49Z
- Last seen
- 2024-07-04T11:27:13Z
- Filename variants
- 3 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type phishing and family phishingx.
Relationship context
16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
17 timestamped observations are arranged from 2019-01-06 to 2026-07-25. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type phishing, family phishingx.
Last seen 861 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- NELCO LIMITED_SKM_C590368369060_417161.pdf
- File type
- MIME
- application/octet-stream
- Size
- 78703
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A possible heap spray exploit has been detected
- A process created a hidden window
- Accessed credential storage registry keys
- Anomalous file deletion behavior detected (10+)
- Attempts to connect to a dead IP:Port (5 unique times)
5 shown
View MITRE ATT&CK details · 5 shown
- T1555.003 — Adversaries may acquire credentials from web browsers by reading files specific to the target browser.Tactics: TA0006
- T1003 — Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.Tactics: TA0006
- T1564 — Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.Tactics: TA0005
- T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.Tactics: TA0011
- T1485 — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.Tactics: TA0040
5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- Credential AccessObjectives: OB0005
- E1485 — Data DestructionObjectives: OB0008
- C0047 — Delete FileObjectives: OC0001
- DiscoveryObjectives: OB0007
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, UDPports 443, 1900, 53
- 5+ outbound connections observed
- 0 domains, 5+ IPs, 0 URLs
- Common ports: 443, 1900, 53
- Protocols: TCP, UDP
View details · 5 shown
- IP
- 8.8.8.8
- Port
- 53
- Protocol
- UDP
- IP
- 239.255.255.250
- Port
- 1900
- Protocol
- UDP
- IP
- 239.255.255.250
- IP
- 188.114.97.7
- Port
- 443
- Protocol
- TCP
- IP
- 188.114.97.7
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- glanmire.com.ru
- Type
- A
- Answers
- 172.67.161.127, 104.21.66.155
- Response
- NOERROR
- Query
- www.adobe.com
- Type
- A
- Answers
- 23.215.223.210, 23.215.223.205
- Response
- NOERROR
- Query
- r.g.bing.com
- Query
- optimizationguide-pa.googleapis.com
- Type
- A
- Answers
- 142.251.143.106, 142.251.143.170, 142.251.143.202, 142.251.143.138
- Response
- NOERROR
- Query
- edgedl.me.gvt1.com
- Type
- A
- Answers
- 34.104.35.123
- Response
- NOERROR
5 shown