- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
bdc9170cea7c45861391bae3cd57767c090ecf8b52b6b9af3cd6ed2305abef9d- SHA1
1c979d26b5983d149c96741a9105a972258fdbd3- MD5
3ee69e78eec1906ee5b896e54b94291f- Filename
- bdc9170c_ssleay32.dll.digitalwatchdog.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 352256
- Compile time
- 2016-09-26T16:21:12Z
- PE platform
- x64 64-bit
- PE sections
- 6
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
7 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context7 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
0%
zip
13098891 bytes
contains
Filename
269c8f99_kenshi.v1.0.64.zip.bin
File type
zip
MIME
application/zip
Size
13098891
SHA1
912668679f9e319a9cf7beb24d2b13c6ecd93e39
0%
peexe
160061400 bytes
drops
Filename
9fbc6ec2_ontrackeasyrecoveryprofessionalforwindows(1).exe.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
160061400
Compile time
2013-01-30T14:21:56Z
0%
peexe
169917936 bytes
drops
Filename
9bcf5c43_ontrackeasyrecoverytoolkitforwindows.exe.bin
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
169917936
Compile time
2013-01-30T14:21:56Z
19%
high
peexe
213707776 bytes
drops
Filename
2675a4bb_ontrack easyrecovery technician v14.0.0.4.exe.bin
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
213707776
0%
rar
140310244 bytes
contains
Filename
3cb467a3_stellar repair for video & photo 6.7.0.2_1.rar.bin
File type
rar
MIME
application/vnd.rar
Size
140310244
SHA1
59e1aa298b407c7530ff60ed1563736f269e1690
Dropped / child files
Files dropped, bundled, or created by the queried file.
2shown
0%
996 bytes
contains
Filename
8165fd75_virusshare_15423c73d2b843c267065d2e1cdbd6a2.bin
MIME
application/octet-stream
Size
996
SHA1
48630e62520aa0ef1a690e006929ea6473430d8b
First seen
2017-04-16T05:41:03Z
0%
1716 bytes
contains
Filename
ed75dac7_version.txt.bin
MIME
text/plain
Size
1716
SHA1
be70ff976df4381ba24c276ecba18c0e4c72a21b
First seen
2020-08-13T03:22:32Z
Analysis details
exec-delaydllknownsrcdebug-checkdotnet64bitobfuscateddynamic-loading
Freshness: Fresh · Last seen 2 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
bdc9170cea7c45861391bae3cd57767c090ecf8b52b6b9af3cd6ed2305abef9d- SHA1
1c979d26b5983d149c96741a9105a972258fdbd3- MD5
3ee69e78eec1906ee5b896e54b94291f- Filename
- bdc9170c_ssleay32.dll.digitalwatchdog.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 352256
- Compile time
- 2016-09-26T16:21:12Z
- PE platform
- x64 64-bit
- PE sections
- 6
- Import libraries
- 3
- TLSH
T14574395266704C85CCD3C278C2734AE3FB74BC2113799BC71B2A856E0F63BC56679269- SSDEEP
6144:sHhGGNDfsOambwCr5DoxYOpmAzOgdUHKCz2A++ghmnlpnC+atKEIMaigjq+e3pWr:sHhGGNDfjDbwCrBoxYOpmAzOgdUHKCzI- Imphash
7df54353439e90bccb3847ac205ebc49- Richhash
45bf7a0cd382382b53be7c775f8c7087- First seen
- 2016-10-01T15:01:26Z
- Last seen
- 2026-11-12T11:49:34Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
7 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
8 timestamped observations are arranged from 2013-01-30 to 2024-09-26. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
2 relationship group(s) provide pivot and infrastructure context.
Last seen 2 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- bdc9170c_ssleay32.dll.digitalwatchdog.bin
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 352256
- Compile time
- 2016-09-26T16:21:12Z
- PE platform
- x64 64-bit
- Entry point
- 233780
- Sections
- 6
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Possible date expiration check, exits too soon after checking local time
- Queries process token information to check for Administrator privileges or UAC elevation status
- SetUnhandledExceptionFilter detected (possible anti-debug)
- The PE entry point is located unusually far into section, indicative of an appended packer stub that jumps to the original entry point (OEP)
- The PE file contains a PDB path
5 shown
View MITRE ATT&CK details · 5 shown
- T1497 · T1518.001 — Checks if the current process is being debuggedTactics: TA0005 · TA0007
- T1055 — Creates a process in suspended mode (likely to inject code)Tactics: TA0004 · TA0005
- T1497 — May sleep (evasive loops) to hinder dynamic analysisTactics: TA0005 · TA0007
- T1033 · T1082 — Queries process token information to check for Administrator privileges or UAC elevation statusTactics: TA0007
- T1082 — Reads software policiesTactics: TA0007
5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- C0059 — Crypto LibraryObjectives: OC0005
- E1027.m02 — Encoding-Standard AlgorithmObjectives: OB0002 · OB0006
- C0002 — HTTP CommunicationObjectives: OC0006
- C0061 — Hashed Message Authentication CodeObjectives: OC0005
5 shown
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
- Compile time: 2016-09-26T16:21:12Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 233780
- Sections
- 6
- Compile time
- 2016-09-26T16:21:12Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: r, rw, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 231115
- Raw size
- 231424
- Permissions
- rx
- Entropy
- 6.15
- Name
- .rdata
- Virtual address
- 237568
- Virtual size
- 41216
- Raw size
- 41472
- Permissions
- r
- Entropy
- 4.8
- Name
- .data
- Virtual address
- 282624
- Virtual size
- 63720
- Raw size
- 62464
- Permissions
- rw
- Entropy
- 4.91
- Name
- .pdata
- Virtual address
- 348160
- Virtual size
- 10248
- Raw size
- 10752
- Permissions
- r
- Entropy
- 5.4
- Name
- .rsrc
- Virtual address
- 360448
- Virtual size
- 1096
- Raw size
- 1536
- Permissions
- r
- Entropy
- 2.61
5 shown
Imports3
3 DLL groups
- 3 import DLL groups
- 5+ imported functions summarized
View details · 3 shown
- Library
- LIBEAY32.dll
- Functions
- Ord(1004), Ord(1005), Ord(1007), Ord(1010), Ord(1011), Ord(1012), Ord(1016), Ord(1023) …
- Library
- MSVCR120.dll
- Functions
- __C_specific_handler, __clean_type_info_names_internal, __CppXcptFilter, __crt_debugger_hook, __crtCaptureCurrentContext, __crtCapturePreviousContext, __crtTerminateProcess, __crtUnhandledException …
- Library
- KERNEL32.dll
- Functions
- DecodePointer, DisableThreadLibraryCalls, EncodePointer, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetSystemTime, GetSystemTimeAsFileTime …
Exports5+
5+ exported items
- 5+ exported items
View details · 5 shown
- Name
- BIO_f_ssl
- Name
- BIO_new_buffer_ssl_connect
- Name
- BIO_new_ssl
- Name
- BIO_new_ssl_connect
- Name
- BIO_ssl_copy_session_id
5 shown
Resources1
1 resources
- 1 resources
- Resource types: RT_VERSION
View details · 1 shown
- Type
- RT_VERSION
- Language
- ENGLISH US