Report - d9cbb80267a9…3f23f14be2

Malicious HighFILE

Quota 46

First seen: 2026-10-22T16:58:25Z
Last seen: 2026-11-12T19:32:48Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmsiltrojan

RELATED INDICATORS17Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
SHA1: 9434603ec9f89a9bb108900e9c0b80a35cec8bb8
MD5: b183e0d9284e8615f8581e03e5d063f3
Filename: win89d5a8.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 68364
Compile time: 2026-10-21T15:12:54Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections46%

VirusSign confidence100%

Relationship context18 visible

Threat classificationmsil

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

18 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

b7996a87cdcc1f33cede45af1040c359c981f6107086f33098674b106e4d95ba

88% high peexe 95985 bytes drops

Filename jh30kfe.exe Family padodor Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

25afd05026324d9b594ec735684b5ec611da544a84acecf5f252b1c60fab37f2

88% high peexe 95985 bytes drops

Filename pie8i4gze.exe Family padodor Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

c3c5c6dfd61ab0816b1456cfbd24d78dc5c581252aec48fe06b4d5ad780452a8

87% high peexe 95954 bytes drops

Family padodor Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 95954

372af392ba32f1af30e67eb6131c5e11a348c4a5a26c079d75aeb47146584339

88% high peexe 96031 bytes drops

Filename cxzns.exe Family padodor Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

77d3a114ef00c35b9d8acf0cd11f56b40f74e0e5ccdd399a330eb2267b8e65c6

88% high peexe 95916 bytes drops

Family padodor Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 95916

Dropped / child files

Files dropped, bundled, or created by the queried file.

3shown

d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2

46% high peexe 68364 bytes drops

Filename win89d5a8.exe Family msil Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

978228083a455adcd3407c110bf18d613f544ad37c47bc2d92a7be87f6c3168d

0% csv 859 bytes drops

Filename MelonityFree.exe.log File type csv MIME text/plain Size 859 SHA1 103116cc0a106be1c6123551babcad59737a4d3b

96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

0% powershell 60 bytes drops

Filename __PSScriptPolicyTest_iugzvutm.mi5.ps1 File type powershell MIME text/plain Size 60 SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d

Related IPs

Network IPs associated with this indicator.

5shown

31.57.97.166

16% medium communicates

CIDR 31.57.97.0/24 Network 31.57.97.0-31.57.97.255 Country The Netherlands First seen 2026-06-27T08:19:29Z Last seen 2026-11-12T19:46:04Z

10.0.89.4

communicates

First seen 2021-11-29T23:43:44Z Last seen 2026-11-12T19:32:45Z

10.0.7.4

0% communicates

First seen 2022-12-05T00:08:13Z Last seen 2026-11-12T19:32:45Z

146.75.117.91

0% DE communicates

CIDR 146.75.0.0/16 Network 146.75.0.0-146.75.255.255 First seen 2023-10-01T03:17:16Z Last seen 2026-11-12T21:15:51Z

162.159.36.2

0% US communicates

CIDR 162.159.0.0/18 Network 162.158.0.0-162.159.255.255 First seen 2023-09-30T16:06:22Z Last seen 2026-11-12T21:42:29Z

Related domains

Domains associated with this indicator.

5shown

12.125.168.192.in-addr.arpa

0% .in-addr.arpa communicates

Root 192.in-addr.arpa TLD in-addr.arpa Subdomain 12.125.168 First seen 2023-10-01T03:29:19Z Last seen 2026-11-12T21:21:12Z

11.125.168.192.in-addr.arpa

0% .in-addr.arpa communicates

Root 192.in-addr.arpa TLD in-addr.arpa Subdomain 11.125.168 First seen 2023-10-02T07:12:46Z Last seen 2026-11-12T19:36:57Z

9.125.168.192.in-addr.arpa

0% .in-addr.arpa communicates

Root 192.in-addr.arpa TLD in-addr.arpa Subdomain 9.125.168 First seen 2023-10-02T03:34:11Z Last seen 2026-11-12T21:21:12Z

26.125.168.192.in-addr.arpa

0% .in-addr.arpa communicates

Root 192.in-addr.arpa TLD in-addr.arpa Subdomain 26.125.168 First seen 2023-09-29T21:49:47Z Last seen 2026-11-12T21:21:12Z

23.125.168.192.in-addr.arpa

0% .in-addr.arpa communicates

Root 192.in-addr.arpa TLD in-addr.arpa Subdomain 23.125.168 First seen 2023-10-01T14:04:07Z Last seen 2026-11-12T19:46:04Z

Analysis details

Severity: hightrojandotnetexepolymorphicfile-overlaydebug-checkexecpersistenceexecutionobfuscated

Freshness: Fresh · Last seen today.

Detection rate: 46%
Threat type: trojan
Family: msil
Confidence: 100%
detection: 46 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2
SHA1: 9434603ec9f89a9bb108900e9c0b80a35cec8bb8
MD5: b183e0d9284e8615f8581e03e5d063f3
Filename: win89d5a8.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 68364
Compile time: 2026-10-21T15:12:54Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T1E96301272FFCAFBCD579D33A5971A22145B48B816C22CE6E4CD5D8E452262A013C573F
SSDEEP: 1536:KE4AYpSk8yjsA+EeXYX7o3xHxSEZtx86kKo5nO:KvAtZtA+XYLo3xHxSEZyKoNO
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2026-10-22T16:58:25Z
Last seen: 2026-11-12T19:32:48Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 46%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family msil.

Relationship context

18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

18 timestamped observations are arranged from 2019-08-20 to 2026-10-21. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 46%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 18 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification msil

Classification context: type trojan, family msil.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: win89d5a8.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 68364
Compile time: 2026-10-21T15:12:54Z
PE platform: x86 32-bit
Entry point: 15342
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkexecobfuscated

View details · 5 shown

.NET source code contains calls to encryption/decryption functions
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
A DLL was loaded from a suspicious directory
Allocates memory with a write watch (potentially for evading sandboxes)

5 shown

View MITRE ATT&CK details · 5 shown

T1140 · T1560 — .NET source code contains calls to encryption/decryption functions
Tactics: TA0005 · TA0009
T1027.002 — .NET source code contains potential unpacker
Tactics: TA0005
T1106 — .NET source code references suspicious native API functions
Tactics: TA0002
T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007

5 shown

View MBC details · 5 shown

C0007 — Allocate Memory
Objectives: OC0002
Anti-Behavioral Analysis
Objectives: OB0001
C0026.001 — Base64
Objectives: OC0004
B0001.002 — CheckRemoteDebuggerPresent
Objectives: OB0001
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDPports 135, 445, 49667

5+ outbound connections observed
0 domains, 5 IPs, 0 URLs
Common ports: 135, 445, 49667, 49949, 49950
Protocols: TCP, UDP

View details · 5 shown

IP: 31.57.97.166
Port: 5559
Protocol: TCP

IP: 162.159.36.2
Port: 53
Protocol: UDP

IP: 146.75.117.91
Port: 443
Protocol: TCP

IP: 10.0.89.4
Port: 50229
Protocol: TCP

IP: 10.0.89.4
Port: 50228
Protocol: TCP

5 shown

DNS request activity5+

A1 response IPs

5+ DNS requests observed
5+ unique queries
1 response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: mozilla.map.fastly.net
Type: A
Answers: 146.75.117.91
Response: NOERROR

Query: 9.125.168.192.in-addr.arpa

Query: 7.125.168.192.in-addr.arpa

Query: 5.125.168.192.in-addr.arpa

Query: 4.125.168.192.in-addr.arpa

5 shown

C2 candidates1

TCPports 5559

1 C2 candidate communications
0 domains, 1 IPs
Common ports: 5559
Protocols: TCP

View details · 1 shown

IP: 31.57.97.166
Port: 5559
Protocol: TCP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2026-10-21T15:12:54Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 15342
Sections: 3
Compile time: 2026-10-21T15:12:54Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 7156
Raw size: 7168
Permissions: rx
Entropy: 5.61

Name: .rsrc
Virtual address: 16384
Virtual size: 1240
Raw size: 1536
Permissions: r
Entropy: 3.72

Name: .reloc
Virtual address: 24576
Virtual size: 12
Raw size: 512
Permissions: r
Entropy: 0.08

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Resources2

2 resources

2 resources
Resource types: RT_MANIFEST, RT_VERSION

View details · 2 shown

Type: RT_VERSION
Language: NEUTRAL

Type: RT_MANIFEST
Language: NEUTRAL

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check