- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
cfdb6410e5c3c81d9c77bbe9e211d10cf80ecb286d19d6fc707273c919399b60- SHA1
7c1e78906b04e7dcb7417e2d27323a8df184f64a- MD5
c824a7d14898ff05ace44e8bbc71756b- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 2174976
- Compile time
- 2024-01-12T06:23:05Z
- PE platform
- x86 32-bit
- PE sections
- 4
- Import libraries
- 2
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 14. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 83%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections83%
VirusSign confidence100%
Relationship context14 visible
Threat classificationvirlock
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
88%
critical
peexe
2063360 bytes
drops
Filename
28acd052_zgcucsei.exe.bin
Family
virlock
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
0%
text
4 bytes
drops
Filename
42507d21_oymcyqgy.bat.bin
File type
text
MIME
text/plain
Size
4
SHA1
10fa29274f31358422d169f9df8c4a35efe53f5a
0%
text
4 bytes
drops
Filename
3409b486_imqoocqm.bat.bin
File type
text
MIME
text/plain
Size
4
SHA1
c11a91659b7389cf51659a23718026953207502d
0%
30 bytes
drops
Filename
2a0053ed_lkqo.txt.bin
MIME
text/plain
Size
30
SHA1
5208f0a868f797c836e15226fbef23c17172d5b9
First seen
2016-11-15T09:18:05Z
0%
ico
20 bytes
contains
Filename
bd7b8910_r.bin
File type
ico
MIME
application/octet-stream
Size
20
SHA1
f9303169a79d768cd2877c896611d8523c80f945
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
74.125.0.0/16
Network
74.125.0.0-74.125.255.255
First seen
2023-10-01T10:57:24Z
Last seen
2026-11-14T20:47:37Z
0%
US
communicates
CIDR
74.125.0.0/16
Network
74.125.0.0-74.125.255.255
First seen
2023-09-28T23:17:26Z
Last seen
2026-11-14T22:19:54Z
0%
US
communicates
CIDR
142.250.0.0/15
Network
142.250.0.0-142.251.255.255
First seen
2023-09-29T08:02:03Z
Last seen
2026-11-13T20:47:56Z
0%
US
communicates
CIDR
74.125.0.0/16
Network
74.125.0.0-74.125.255.255
First seen
2023-09-30T17:33:23Z
Last seen
2026-11-14T23:01:03Z
0%
US
communicates
CIDR
74.125.0.0/16
Network
74.125.0.0-74.125.255.255
First seen
2023-09-30T06:37:09Z
Last seen
2026-11-14T17:18:34Z
Related domains
Domains associated with this indicator.
2shown
0%
.com
communicates
Root
bitcoincharts.com
TLD
com
Subdomain
api
First seen
2023-10-03T00:14:08Z
Last seen
2026-11-15T04:23:41Z
5%
high
.com
communicates
Root
google.com
TLD
com
First seen
2023-10-01T00:09:50Z
Last seen
2026-11-15T04:47:40Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
HTTP status
200
Content length
180130
Content SHA256
018c4200a145f429fdc38dd2c1b30ab09aa33e502ef2cee2eb4dffa8fa3cdb1d
First seen
2015-07-03T09:20:53Z
Last seen
2025-06-14T08:48:43Z
0%
communicates
TLD
com
HTTP status
200
Content length
221756
Content SHA256
c9bbde7b5c63df5e995106c660652cf50099f798c416c9a0be21429856418f8a
First seen
2010-06-15T08:48:21Z
Analysis details
Severity: criticaltrojanexepolymorphicinput-checkpersistencedebug-checkexec-delayenv-checkobfuscated
Freshness: Historical · Last seen 322 days ago.
- Detection rate
- 83%
- Threat type
- trojan
- Family
- virlock
- Confidence
- 100%
- detection
- 83 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
cfdb6410e5c3c81d9c77bbe9e211d10cf80ecb286d19d6fc707273c919399b60- SHA1
7c1e78906b04e7dcb7417e2d27323a8df184f64a- MD5
c824a7d14898ff05ace44e8bbc71756b- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 2174976
- Compile time
- 2024-01-12T06:23:05Z
- PE platform
- x86 32-bit
- PE sections
- 4
- Import libraries
- 2
- TLSH
T1E4A5F1FAD973EC09C41F61FB9186951C7AAFF513C3B960C3BAFC5101A0943E9A9724A1- SSDEEP
49152:yj6jiPha6gCtER3N1/JW4Ne1sVvOTW18TnfV2X0pJsjWhO:nR6gCGRnM- Imphash
41a62cb8b3c6c426c9a3b8f0c19b4225- Richhash
4be8b80661d6c28867ae587a632db598- First seen
- 2024-10-23T04:58:41Z
- Last seen
- 2025-12-27T21:36:58Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 14. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 83%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family virlock.
Relationship context
14 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
15 timestamped observations are arranged from 2010-06-15 to 2024-10-24. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family virlock.
Last seen 322 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 2174976
- Compile time
- 2024-01-12T06:23:05Z
- PE platform
- x86 32-bit
- Entry point
- 4096
- Sections
- 4
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A process attempted to delay the analysis task.
- Abnormal high CPU Usage
- At least one IP Address, Domain, or File Name was found in a crypto call
- Attempts to disable UAC
- Attempts to modify Explorer settings to prevent file extensions from being displayed
5 shown
View MITRE ATT&CK details · 5 shown
- T1053 — Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.Tactics: TA0002 · TA0003 · TA0004
- T1202 — Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.Tactics: TA0005
- T1547.001 — Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.Tactics: TA0003 · TA0004
- T1057 — Adversaries may attempt to get information about running processes on a system.Tactics: TA0007
- T1564 — Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.Tactics: TA0005
5 shown
View MBC details · 5 shown
- C0007 — Allocate MemoryObjectives: OC0002
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- B0009.005 — Check Registry KeysObjectives: OB0001
- Command and ControlObjectives: OB0004
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 80, 137, 443
- 5+ outbound connections observed
- 2 domains, 5+ IPs, 2 URLs
- Common ports: 80, 137, 443
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- Domain
- google.com
- URL
- http://google.com/
- Protocol
- HTTP
- Domain
- 209.85.145.138
- URL
- http://209.85.145.138/
- Protocol
- HTTP
- IP
- 74.125.128.138
- Port
- 80
- Protocol
- TCP
- IP
- 74.125.128.138
- IP
- 74.125.128.102
- Port
- 80
- Protocol
- TCP
5 shown
DNS request activity4
A5+ response IPs
- 4 DNS requests observed
- 2 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 4 shown
- Query
- google.com
- Type
- A
- Answers
- 209.85.145.102, 64.233.181.101, 209.85.145.139, 64.233.181.113, 64.233.181.138, 209.85.145.138, 209.85.145.113, 64.233.181.100 …
- Response
- NOERROR
- Query
- google.com
- Type
- A
- Answers
- 142.250.69.206
- Response
- NOERROR
- Query
- google.com
- Type
- A
- Answers
- 74.125.128.101, 108.177.119.100, 74.125.128.100, 108.177.119.113, 74.125.128.102, 74.125.143.138, 74.125.143.100, 74.125.128.139 …
- Response
- NOERROR
- Query
- api.bitcoincharts.com
- Type
- A
- Answers
- 144.76.195.253
- Response
- NOERROR
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x86 32-bit4 sections
- Platform: x86 32-bit
- Sections: 4
- Entry point: present
- Compile time: 2024-01-12T06:23:05Z
View details · 1 shown
- Platform
- x86 32-bit
- Entry point
- 4096
- Sections
- 4
- Compile time
- 2024-01-12T06:23:05Z
PE sections4
4 sections
- 4 PE sections
- Common permissions: rw, r, rx
- 4 unique section names
View details · 4 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 733184
- Raw size
- 733184
- Permissions
- rx
- Entropy
- 7.2
- Name
- .rdata
- Virtual address
- 737280
- Virtual size
- 8192
- Raw size
- 10240
- Permissions
- r
- Entropy
- 0.27
- Name
- .data
- Virtual address
- 745472
- Virtual size
- 1425408
- Raw size
- 1425408
- Permissions
- rw
- Entropy
- 5.72
- Name
- .rsrc
- Virtual address
- 2170880
- Virtual size
- 4608
- Raw size
- 4608
- Permissions
- rw
- Entropy
- 6.02
Imports2
2 DLL groups
- 2 import DLL groups
- 4 imported functions summarized
View details · 2 shown
- Library
- kernel32.dll
- Functions
- GetCommandLineA, GetSystemDefaultLangID, VirtualAlloc
- Library
- user32.dll
- Functions
- GetClipboardSequenceNumber
Resources2
2 resources
- 2 resources
- Resource types: RT_GROUP_ICON, RT_ICON
View details · 2 shown
- Type
- RT_ICON
- Language
- ENGLISH US
- Type
- RT_GROUP_ICON
- Language
- ENGLISH US