Report - c8352baa0192…9eb3209a6c

Malicious CriticalFILE

Quota 40

First seen: 2021-11-13T18:05:10Z
Last seen: 2025-01-31T00:20:04Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmsiltrojan

RELATED INDICATORS21Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: c8352baa0192f9bdbf7b0d47d76f9b592ba602ea001fdc21e281899eb3209a6c
SHA1: a1dd38defe16dc78055f06f4ae7427a9f0c6a5cf
MD5: e1685e62827387c7f34e2b2198d0e5f7
Filename: c8352baa_swift document copy.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 472064
Compile time: 2021-11-10T23:21:42Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 21. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 79%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections79%

VirusSign confidence100%

Relationship context21 visible

Threat classificationmsil

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

21 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

f5b8c5741947560bdae6819578ac767dd4bd696fbcf8b28982753be47a2e0503

32% high rar 274009 bytes contains

Filename f5b8c574_e18e887a20fe4285f7651b22b155be6d.file.bin Family sabsik Type trojan File type rar MIME application/vnd.rar

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

0115933eb30fdbc55710a22b384382f962721223169ed6a4cd8f5ebb6b00bb31

0% ico 2238 bytes contains

Filename 0115933e_50.ico.bin File type ico MIME application/octet-stream Size 2238 SHA1 935e976ef2f852ff392118c2636b343179e26e95

51b9ccee81e3db2f8ee5d386e92ab932ed65f9d28a11349b2e17ae8551c14c23

0% png 24653 bytes contains

Filename 51b9ccee_00821958.png.bin File type png MIME application/octet-stream Size 24653 SHA1 034c4f8a49c6da973332a2991ee492c4ecfed427

2e213434188d6d3574f3fcbcf3624ba450dd938ea5cfe0ed999004a736aefcb3

0% 104 bytes contains

Filename 2e213434_128.bin MIME application/octet-stream Size 104 SHA1 b6f94c18ec2da7432113bf95c3d5ac9153610349 First seen 2023-09-28T19:53:22Z

228a728163d85eabd333a9dcab5d87816b5bc7e63e5283b1063d3292ed143477

0% ico 1150 bytes contains

Filename 228a7281_6.ico.bin File type ico MIME application/octet-stream Size 1150 SHA1 a53316c635c0d2421d163c4beaf064b24d92ee9c

0e196151cb11ff2a1f1a5daf0beb5724caa7014838304ad1b0a3c71ff18f5468

0% ico 9662 bytes contains

Filename 0e196151_4.ico.bin File type ico MIME application/octet-stream Size 9662 SHA1 af74bad00407885ab4675e3b44e1cac4acca5bd4

Related IPs

Network IPs associated with this indicator.

5shown

64.190.62.111

16% high DE communicates

CIDR 64.190.62.0/23 Network 64.190.62.0-64.190.63.255 First seen 2023-10-09T20:14:00Z Last seen 2026-11-03T12:35:15Z

198.54.117.218

16% high US communicates

CIDR 198.54.112.0/20 Network 198.54.112.0-198.54.127.255 First seen 2023-10-01T11:02:22Z Last seen 2026-11-09T17:03:50Z

198.54.117.217

16% high US communicates

CIDR 198.54.112.0/20 Network 198.54.112.0-198.54.127.255 First seen 2023-09-29T02:17:47Z Last seen 2026-11-09T17:03:50Z

198.54.117.216

5% high US communicates

CIDR 198.54.112.0/20 Network 198.54.112.0-198.54.127.255 First seen 2023-09-28T19:43:00Z Last seen 2026-11-09T17:03:50Z

198.54.117.215

20% medium US communicates

CIDR 198.54.112.0/20 Network 198.54.112.0-198.54.127.255 First seen 2023-10-01T11:02:22Z Last seen 2026-11-09T17:03:50Z

Related domains

Domains associated with this indicator.

5shown

dependablemarket.com

0% .com communicates

Root dependablemarket.com TLD com First seen 2021-09-15T07:51:44Z Last seen 2025-12-07T06:27:30Z

www.worryfreeworld.com

0% .com communicates

Root worryfreeworld.com TLD com Subdomain www First seen 2022-02-20T04:17:37Z Last seen 2026-05-12T20:44:01Z

worryfreeworld.com

5% low .com communicates

Root worryfreeworld.com TLD com First seen 2025-08-06T20:57:24Z Last seen 2026-04-19T10:21:33Z

stealameme.com

.com communicates

Root stealameme.com TLD com First seen 2021-09-15T07:51:44Z Last seen 2026-05-24T13:39:13Z

www.stealameme.com

.com communicates

Root stealameme.com TLD com Subdomain www First seen 2021-09-15T07:51:44Z Last seen 2026-01-05T19:00:55Z

Related URLs

URLs associated with this indicator.

5shown

http://www.bestpriceph.store/upwd/

0% communicates

TLD store HTTP status 200 Content length 25319 Content SHA256 3b8a21beff2c38dad1d682f7876cf1233fd7a8325b99292400828b6d9c4b3c38 First seen 2021-11-12T08:41:28Z

http://www.academiconai.com/upwd/

4% low communicates

TLD com HTTP status 200 Content length 44504 Content SHA256 bb58af90f75e1d5a1c902200c322da87efbe7df6d2c7909cbe161080bcc2773b First seen 2021-11-11T20:22:34Z

http://www.thewisdomarts.com/upwd/

4% low communicates

TLD com HTTP status 200 Content length 2548 Content SHA256 4abfff1b6d43fa2223c1fe95e454321680c6456a9071255037bd61d7213a997f First seen 2021-11-11T20:22:34Z

http://www.petitesecrevisses.com/upwd/

4% low communicates

TLD com HTTP status 200 Content length 63433 Content SHA256 e7f2ade2ebe9537681811de39c96ff43865ef308c064ade6cb660d277e74be32 First seen 2021-11-11T14:07:30Z

http://www.blessedunrest.com/upwd/

7% high communicates

TLD com HTTP status 404 Content length 13792 Content SHA256 2b8001fcc491a43ac6b03ea26fd5aad52fbb985de22723328f6ad3225dfb205f First seen 2021-11-12T08:41:28Z

Analysis details

Severity: criticaltrojanexedebug-checkdynamic-loadingcpu-clockmalwaredotnetratformbookloader

Freshness: Historical · Last seen 652 days ago.

Detection rate: 79%
Threat type: trojan
Family: msil
Confidence: 100%
detection: 79 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: c8352baa0192f9bdbf7b0d47d76f9b592ba602ea001fdc21e281899eb3209a6c
SHA1: a1dd38defe16dc78055f06f4ae7427a9f0c6a5cf
MD5: e1685e62827387c7f34e2b2198d0e5f7
Filename: c8352baa_swift document copy.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 472064
Compile time: 2021-11-10T23:21:42Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T10AA43B2C3B410AE2ED1DB03B4D160A08BB668F172240AA8277DB69C7DF5F3B65D15DA4
SSDEEP: 6144:RyfeeboeUdNa5LEZQv77AdItCCE+BL+5V71wMbnQ5iwDcH+trLyAHmP5:VeUdNa5LEZQz7yJ1/Q5UYrZHw5
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2021-11-13T18:05:10Z
Last seen: 2025-01-31T00:20:04Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 21. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 79%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family msil.

Relationship context

21 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

22 timestamped observations are arranged from 2021-09-15 to 2025-08-06. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 79%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 21 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification msil

Classification context: type trojan, family msil.

Intelligence freshness Historical

Last seen 652 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: c8352baa_swift document copy.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 472064
Compile time: 2021-11-10T23:21:42Z
PE platform: x86 32-bit
Entry point: 429870
Sections: 3

Observed behavior

summary

Behavioral indicators observed during analysis. More details and additional structured data are available through API and data access.

debug-checkcpu-clockdynamic-loading

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 80, 53

5+ outbound connections observed
5+ domains, 5+ IPs, 5+ URLs
Common ports: 80, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: www.lightswartoyof5.xyz
URL: http://www.lightswartoyof5.xyz/upwd/
Protocol: HTTP

Domain: www.insularrofioa.xyz
URL: http://www.insularrofioa.xyz/upwd/?_fql-nt=+wymnqauqnghdqvovlzoljtt2gzbnftdqbq2domqecv4hltc8ldxphsfx+wmczzjbl1ukw==&sl04c=6lttx2nxcrmpmxkp
Protocol: HTTP

Domain: www.insularrofioa.xyz
URL: http://www.insularrofioa.xyz/upwd/?_fql-nt=+wymnqauqnghdqvovlzoljtt2gzbnftdqbq2domqecv4hltc8ldxphsfx+wmczzjbl1ukw==&jpj0n=_tvhijthplg8fb
Protocol: HTTP

Domain: www.insularrofioa.xyz
URL: http://www.insularrofioa.xyz/upwd/
Protocol: HTTP

Domain: www.blessedunrest.com
URL: http://www.blessedunrest.com/upwd/
Protocol: HTTP

5 shown

DNS request activity5+

A, A/AAAA5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A, A/AAAA
Response codes: NOERROR

View details · 5 shown

Query: www.insularrofioa.xyz
Type: A
Answers: 198.54.117.216, 198.54.117.215, 198.54.117.217, 198.54.117.218, 198.54.117.212, 198.54.117.210, 198.54.117.211
Response: NOERROR

Query: www.xbrlytunk.quest
Type: A/AAAA
Answers: 172.67.207.10, 104.21.45.4, 2606:4700:3032::6815:2d04, 2606:4700:3030::ac43:cf0a
Response: NOERROR

Query: www.wrightpainters.com
Type: A
Answers: 192.185.183.48
Response: NOERROR

Query: www.wowvital.com
Type: A
Answers: 154.208.173.121
Response: NOERROR

Query: www.worryfreeworld.com
Type: A
Answers: 110.42.135.229
Response: NOERROR

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2021-11-10T23:21:42Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 429870
Sections: 3
Compile time: 2021-11-10T23:21:42Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 421684
Raw size: 421888
Permissions: rx
Entropy: 6.58

Name: .rsrc
Virtual address: 434176
Virtual size: 49070
Raw size: 49152
Permissions: r
Entropy: 6.96

Name: .reloc
Virtual address: 483328
Virtual size: 12
Raw size: 512
Permissions: r
Entropy: 0.1

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION

View details · 4 shown

Type: RT_ICON
Language: CZECH NEUTRAL

Type: RT_GROUP_ICON
Language: CZECH NEUTRAL

Type: RT_VERSION
Language: CZECH NEUTRAL

Type: RT_MANIFEST
Language: CZECH NEUTRAL

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check