Report - cdfe4bca1b62…4f8b6d9d4d

Malicious HighFILE

Quota 32

First seen: 2019-06-14T13:21:41Z
Last seen: 2026-10-19T03:37:25Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYdarkkomettrojan

RELATED INDICATORS19Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: cdfe4bca1b6265d2e4b485cfb85a5148696f308a6d7b890704180a4f8b6d9d4d
SHA1: acb7a2f2448608e01d55460f562c6a83e45552c9
MD5: 9757f34186a6d308d081c901009dbc95
Filename: vcredist2013_x64.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 7972864
Compile time: 1992-06-19T22:22:17Z
PE platform: x86 32-bit
PE sections: 8

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 21. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 96%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections96%

VirusSign confidence100%

Relationship context21 visible

Threat classificationdarkkomet

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

21 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

cdfe4bca1b6265d2e4b485cfb85a5148696f308a6d7b890704180a4f8b6d9d4d

96% high peexe 7972864 bytes drops

Filename vcredist2013_x64.exe Family darkkomet Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

cdfe4bca1b6265d2e4b485cfb85a5148696f308a6d7b890704180a4f8b6d9d4d

96% high peexe 7972864 bytes drops

Filename vcredist2013_x64.exe Family darkkomet Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

c88a0b907419a70c27ab7c1f8e5fb54441a4d9c3567e4c928fa7b2091194aecf

0% text 7 bytes drops

Filename campaign File type text MIME text/plain Size 7 SHA1 42a8f651d79fd005eeac0612df6442b983a01184

c39d7a8de2909a379c697ab71fd30b31d7ddd7b9568a89b99d307dda3dab1d8f

0% xml 5906 bytes contains

Filename dttcodexgigas.db864e6567a44d9836d3a4cba41488a2341c731b File type xml MIME application/xml Size 5906 SHA1 db864e6567a44d9836d3a4cba41488a2341c731b

97da3c982874ec87dcba39e8ae9e8c8df8acd4e06f360a8a4179b82fa0014346

0% xml 174820 bytes drops

Filename E8752C7E-4238-4257-9B8E-A745B2D3C64F File type xml MIME application/xml Size 174820 SHA1 02e52cc19f3e2222f17e8bbf173c4f7e994e587d

255a65d30841ab4082bd9d0eea79d49c5ee88f56136157d8d6156aef11c12309

0% ini 26 bytes drops

Filename turbotax 2025 installer.exe:Zone.Identifier File type ini MIME text/plain Size 26 SHA1 6693ba299ec1881249d59262276a0d2cb21f8e64

Related IPs

Network IPs associated with this indicator.

5shown

172.253.139.132

5% high US communicates

CIDR 172.253.128.0/17 Network 172.253.0.0-172.253.255.255 First seen 2025-12-08T06:41:10Z Last seen 2026-11-12T04:50:45Z

192.178.155.139

0% US communicates

CIDR 192.178.0.0/15 Network 192.178.0.0-192.179.255.255 First seen 2025-01-25T03:28:00Z Last seen 2026-11-13T10:36:27Z

192.178.155.138

0% US communicates

CIDR 192.178.0.0/15 Network 192.178.0.0-192.179.255.255 First seen 2025-01-24T22:01:56Z Last seen 2026-11-13T10:36:27Z

192.178.155.113

0% US communicates

CIDR 192.178.0.0/15 Network 192.178.0.0-192.179.255.255 First seen 2025-01-25T03:25:59Z Last seen 2026-11-13T10:36:27Z

192.178.155.102

0% US communicates

CIDR 192.178.0.0/15 Network 192.178.0.0-192.179.255.255 First seen 2025-01-25T02:27:01Z Last seen 2026-11-13T10:36:27Z

Related domains

Domains associated with this indicator.

5shown

atm.office.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.office.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-13T10:06:36Z

usercontent.google.com

0% .com communicates

Root google.com TLD com Subdomain usercontent First seen 2023-09-28T21:43:59Z Last seen 2026-11-13T09:16:17Z

drive.usercontent.google.com

0% .com communicates

Root google.com TLD com Subdomain drive.usercontent First seen 2023-09-28T16:05:17Z Last seen 2026-11-13T10:37:27Z

o.pki.goog

0% .goog communicates

Root pki.goog TLD goog Subdomain o First seen 2024-04-25T11:51:54Z Last seen 2026-11-13T10:37:28Z

c.pki.goog

0% .goog communicates

Root pki.goog TLD goog Subdomain c First seen 2023-11-18T05:22:31Z Last seen 2026-11-13T10:37:27Z

Related URLs

URLs associated with this indicator.

5shown

https://docs.google.com:80/uc?…

5% high communicates

TLD com First seen 2018-03-15T10:44:22Z Last seen 2026-11-10T18:11:41Z

https://docs.google.com:80/uc?…

9% high communicates

TLD com First seen 2018-03-15T08:48:49Z Last seen 2026-11-10T18:11:41Z

https://drive.usercontent.google.com/download?…

5% low communicates

TLD com HTTP status 404 Content length 1652 Content SHA256 8f33fb518b29cccebae63184caf6d1f48c50384aeea4570017803bb3596c9c1d First seen 2024-02-09T10:00:09Z

https://docs.google.com/uc?…

10% medium communicates

TLD com HTTP status 303 Content length 1652 Content SHA256 9128ae15a14813dd9b5e3251e9758841c8957c5313cfd198cf1d0c2a966200e6 First seen 2017-09-29T15:41:51Z

http://freedns.afraid.org/api/?…

14% medium communicates

TLD org HTTP status 200 Content length 31 Content SHA256 2907b7616e2de83d5a58ebeb7b757b4f30a8ad536ff72e26be0ce87979d60148 First seen 2015-09-24T12:55:17Z

Analysis details

Severity: hightrojanpersistencebobsoftdebug-checkexeexec-delayusb-checkpolymorphicobfuscatedsigned

Freshness: Recent · Last seen 25 days ago.

Detection rate: 96%
Threat type: trojan
Family: darkkomet
Confidence: 100%
detection: 96 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: cdfe4bca1b6265d2e4b485cfb85a5148696f308a6d7b890704180a4f8b6d9d4d
SHA1: acb7a2f2448608e01d55460f562c6a83e45552c9
MD5: 9757f34186a6d308d081c901009dbc95
Filename: vcredist2013_x64.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 7972864
Compile time: 1992-06-19T22:22:17Z
PE platform: x86 32-bit
PE sections: 8
Import libraries: 12
TLSH: T1D6862332F2A04037D1B20675AC5BD3646C3ABB142F34685BBBE81E5C5F396C279B6253
SSDEEP: 196608:eLqPcMjmjy94Io62HYJPBRlDSn0SexbbfLMciVE/O:eGw2n2HGR3S452WO
Imphash: 332f7ce65ead0adfb3d35147033aabe9
First seen: 2019-06-14T13:21:41Z
Last seen: 2026-10-19T03:37:25Z
Filename variants: 4 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 21. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 96%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family darkkomet.

Relationship context

21 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

20 timestamped observations are arranged from 1992-06-19 to 2025-12-08. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 96%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 21 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification darkkomet

Classification context: type trojan, family darkkomet.

Intelligence freshness Recent

Last seen 25 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: vcredist2013_x64.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 7972864
Compile time: 1992-06-19T22:22:17Z
PE platform: x86 32-bit
Entry point: 633728
Sections: 8

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

usb-checkdebug-checkexec-delayobfuscatedpersistence

View details · 5 shown

A DLL was loaded from a suspicious directory
A document file initiated network communications indicative of a potential exploit or payload download
A document or script file initiated network communications indicative of a potential exploit or payload download
A potential decoy document was displayed to the user
Accesses the UserInfo registry key, potentially used for discovery

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1071 · T1221 — A document file initiated network communications indicative of a potential exploit or payload download
Tactics: TA0005 · TA0011
T1071 — A potential decoy document was displayed to the user
Tactics: TA0011
T1082 — Checks available memory
Tactics: TA0007
T1497 — Checks for mouse movement
Tactics: TA0005 · TA0007

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0030 — C2 Communication
Objectives: OB0004
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 80, 53

5+ outbound connections observed
3 domains, 5+ IPs, 5 URLs
Common ports: 443, 80, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: docs.google.com
URL: https://docs.google.com:80/uc?id=0bxsmxgfpizfsvlvsoglevgxuzvk&export=download
Protocol: HTTP

Domain: docs.google.com
URL: https://docs.google.com/uc?id=0bxsmxgfpizfsvlvsoglevgxuzvk&export=download
Protocol: HTTP

Domain: freedns.afraid.org
URL: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Protocol: HTTP

Domain: drive.usercontent.google.com
URL: https://drive.usercontent.google.com/download?id=0bxsmxgfpizfsvlvsoglevgxuzvk&export=download
Protocol: HTTP

Domain: docs.google.com
URL: https://docs.google.com:80/uc?id=0bxsmxgfpizfstmlvykxhsdg5tzq&export=download
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: xred.mooo.com

Query: freedns.afraid.org
Type: A
Answers: 67.220.81.150
Response: NOERROR

Query: freedns.afraid.org

Query: sals

Query: o.pki.goog

5 shown

C2 candidates2

DNS, HTTPports 53

2 C2 candidate communications
2 domains, 0 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 2 shown

Domain: xred.mooo.com
Port: 53
Protocol: DNS

Domain: docs.google.com
Protocol: HTTP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 1992-06-19T22:22:17Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 633728
Sections: 8
Compile time: 1992-06-19T22:22:17Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: rw, rs, rx
5+ unique section names

View details · 5 shown

Name: CODE
Virtual address: 4096
Virtual size: 629740
Raw size: 629760
Permissions: rx
Entropy: 6.57

Name: DATA
Virtual address: 634880
Virtual size: 11860
Raw size: 12288
Permissions: rw
Entropy: 4.85

Name: BSS
Virtual address: 647168
Virtual size: 4581
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .idata
Virtual address: 655360
Virtual size: 10818
Raw size: 11264
Permissions: rw
Entropy: 4.92

Name: .tls
Virtual address: 667648
Virtual size: 16
Raw size: 0
Permissions: rw
Entropy: 0.0

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: kernel32.dll
Functions: BeginUpdateResourceA, CloseHandle, CompareStringA, CopyFileA, CreateDirectoryA, CreateEventA, CreateFileA, CreateFileMappingA …

Library: user32.dll
Functions: ActivateKeyboardLayout, AdjustWindowRectEx, BeginPaint, CallNextHookEx, CallWindowProcA, CharLowerA, CharLowerBuffA, CharNextA …

Library: advapi32.dll
Functions: AdjustTokenPrivileges, CloseServiceHandle, GetUserNameA, LookupPrivilegeValueA, OpenProcessToken, OpenSCManagerA, RegCloseKey, RegCreateKeyExA …

Library: oleaut32.dll
Functions: GetErrorInfo, SafeArrayCreate, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SysAllocStringLen, SysFreeString, SysReAllocStringLen …

Library: version.dll
Functions: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_STRING, RT_BITMAP, RT_RCDATA, RT_CURSOR, RT_GROUP_CURSOR

View details · 5 shown

Type: RT_CURSOR
Language: NEUTRAL

Type: RT_BITMAP
Language: NEUTRAL

Type: RT_ICON
Language: NEUTRAL

Type: RT_ICON
Language: TURKISH DEFAULT

Type: RT_DIALOG
Language: NEUTRAL

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5+ issuers

Example subject: Microsoft Time-Stamp Service
Issued by: Microsoft Time-Stamp PCA

View details · 5 shown

Subject: Microsoft Time-Stamp Service
Issuer: Microsoft Time-Stamp PCA
Fingerprint: FDE2F5A6EA8EC00002853EA2B2D3A4C96764901C

Subject: Microsoft Corporation
Issuer: Microsoft Code Signing PCA
Fingerprint: 3BDA323E552DB1FDE5F4FBEE75D6D5B2B187EEDC

Subject: Microsoft Code Signing PCA
Issuer: Microsoft Root Certificate Authority
Fingerprint: 3CAF9BA2DB5570CAF76942FF99101B993888E257

Subject: Microsoft Time-Stamp PCA
Issuer: Microsoft Root Certificate Authority
Fingerprint: 375FCB825C3DC3752A02E34EB70993B4997191EF

Subject: Microsoft Corporation
Issuer: Microsoft Code Signing PCA 2011
Fingerprint: 54DA79490495AA6D7898B183D86EA600E3FC5EBF

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check