- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEVirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
- SHA256
da8c07ea7a87c60dd82c978f1ee4f6f3f4552b4b66e342ed1289f75f0f49b447- SHA1
1716016f22a4318643b9ce4956047bcd4d21ae5d- MD5
f7f641c2a69852fb87182579245947d9- Filename
- fn2a7.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 3422576
- PE platform
- x64 64-bit
- PE sections
- 8
- Import libraries
- 1
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
High-confidence evidence. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (25%).
Confidence signal
VirusSign reports 95% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections25%
VirusSign confidence95%
Relationship context15 visible
Threat classificationloader
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
text
20 bytes
drops
Filename
~stg_4e02.tmp
File type
text
MIME
text/plain
Size
20
SHA1
a5c60ee7d9227fcaba938dbb99521c03597fb908
0%
118784 bytes
drops
Filename
History
MIME
application/octet-stream
Size
118784
SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2
First seen
2021-05-09T10:25:25Z
0%
94208 bytes
drops
Filename
idkop.tmpdb
MIME
application/octet-stream
Size
94208
SHA1
a2752bdcb3513697b3ce3f31e4ea3238a81901cd
First seen
2016-04-06T07:24:47Z
0%
98304 bytes
drops
Filename
fpzmdbktf.tmpdb
MIME
application/vnd.sqlite3
Size
98304
SHA1
cdccc11837cddb657eb0ef6a01202451ecdf4992
First seen
2022-01-18T14:24:35Z
0%
59392 bytes
drops
Filename
jbvmfve.tmpdb
MIME
application/octet-stream
Size
59392
SHA1
7ae3ff47f25f084f967715f9625cedfab92f4543
First seen
2015-10-21T18:33:44Z
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2023-09-29T18:52:58Z
Last seen
2026-10-28T14:15:11Z
0%
SE
communicates
CIDR
95.100.176.0/22
Network
95.100.176.0-95.100.191.255
First seen
2024-10-17T09:55:42Z
Last seen
2026-11-13T04:26:55Z
0%
US
communicates
CIDR
172.67.128.0/17
Network
172.64.0.0-172.71.255.255
First seen
2023-10-02T18:08:32Z
Last seen
2026-10-29T00:51:18Z
0%
US
communicates
CIDR
8.6.112.0/24
Network
8.6.112.0-8.6.112.255
First seen
2024-03-06T08:09:44Z
Last seen
2026-11-13T12:59:41Z
0%
US
communicates
CIDR
8.47.69.0/24
Network
8.47.69.0-8.47.69.255
First seen
2024-03-05T22:42:49Z
Last seen
2026-11-13T12:59:41Z
Related domains
Domains associated with this indicator.
4shown
11%
medium
.info
communicates
Root
dfwioeiofwr.info
TLD
info
Subdomain
gate
First seen
2026-08-02T11:27:18Z
Last seen
2026-10-18T23:41:42Z
0%
.org
communicates
Root
ipify.org
TLD
org
Subdomain
api
First seen
2023-10-01T04:34:19Z
Last seen
2026-11-13T13:09:31Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
x1.i
First seen
2023-09-30T05:09:58Z
Last seen
2026-11-13T13:07:10Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
i
First seen
2023-09-30T12:18:28Z
Last seen
2026-11-13T13:07:10Z
Related URLs
URLs associated with this indicator.
1shown
0%
communicates
TLD
org
HTTP status
200
Content length
1391
Content SHA256
96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
First seen
2020-12-05T10:22:33Z
Analysis details
Severity: criticaltrojaninvalid-signatureexe64bitfile-overlaypersistencediscoverycollectionstealerspywareobfuscatedsigned
Freshness: Aging · Last seen 32 days ago.
- Detection rate
- 25%
- Threat type
- trojan
- Family
- loader
- Confidence
- 95%
- confidence
- 95 · VirusSign confidence; engine detections are reported separately.
Overview
- SHA256
da8c07ea7a87c60dd82c978f1ee4f6f3f4552b4b66e342ed1289f75f0f49b447- SHA1
1716016f22a4318643b9ce4956047bcd4d21ae5d- MD5
f7f641c2a69852fb87182579245947d9- Filename
- fn2a7.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 3422576
- PE platform
- x64 64-bit
- PE sections
- 8
- Import libraries
- 1
- TLSH
T1B3F55A07BCE049E9D4A9973289B751927B34BC084B3263DB2E90B7782F727D09D76B50- SSDEEP
24576:fTJ2eLUmFqbYn1NJI2L6EYIwKlTw3V4CAZcp3yTaRldzBeletrKDX7jn4RD069D:fTJtonbYrJpLZYIRYVFFgaj8Eb9D- Imphash
d42595b695fc008ef2c56aabd8efd68e- First seen
- 2026-07-31T10:44:41Z
- Last seen
- 2026-10-12T01:49:22Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
High-confidence evidence. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (25%).
Confidence signal
VirusSign reports 95% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family loader.
Relationship context
15 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2015-10-21 to 2026-08-02. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family loader.
Last seen 32 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- fn2a7.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 3422576
- PE platform
- x64 64-bit
- Entry point
- 474464
- Sections
- 8
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- AV process strings found (often used to terminate AV products)
- Allocates memory in foreign processes
- Classification label
- Contains modern PE file flags such as dynamic base (ASLR) or NX
- Creates a process in suspended mode (likely to inject code)
5 shown
View MITRE ATT&CK details · 5 shown
- T1055 — Allocates memory in foreign processesTactics: TA0004 · TA0005
- T1548 — Found direct / indirect Syscall (likely to bypass EDR)Tactics: TA0004
- T1005 — Found many strings related to Crypto-Wallets (likely being stolen)Tactics: TA0009
- T1057 — Queries a list of all running processesTactics: TA0007
- T1082 — Queries the volume information (name, serial number etc) of a deviceTactics: TA0007
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- Anti-Static AnalysisObjectives: OB0002
- CommunicationObjectives: OC0006
- Defense EvasionObjectives: OB0006
- C0002 — HTTP CommunicationObjectives: OC0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 443, 80, 53
- 5+ outbound connections observed
- 1 domains, 5+ IPs, 1 URLs
- Common ports: 443, 80, 53
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- IP
- 199.232.210.172
- Port
- 80
- Protocol
- TCP
- IP
- 1.1.1.1
- Port
- 53
- Protocol
- UDP
- Domain
- x1.i.lencr.org
- URL
- http://x1.i.lencr.org/
- Protocol
- HTTP
- IP
- 95.100.177.68
- Port
- 80
- Protocol
- TCP
- IP
- 8.6.112.0
- Port
- 443
- Protocol
- TCP
5 shown
DNS request activity4
A5+ response IPs
- 4 DNS requests observed
- 3 unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 4 shown
- Query
- gate.dfwioeiofwr.info
- Type
- A
- Answers
- 172.67.194.120, 104.21.20.212
- Response
- NOERROR
- Query
- x1.i.lencr.org
- Type
- A
- Answers
- 95.100.177.68
- Response
- NOERROR
- Query
- api.ipify.org
- Type
- A
- Answers
- 8.47.69.0, 8.6.112.0
- Response
- NOERROR
- Query
- api.ipify.org
- Type
- A
- Answers
- 104.26.12.205, 104.26.13.205, 172.67.74.152
- Response
- NOERROR
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 474464
- Sections
- 8
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: r, rw, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 1013617
- Raw size
- 1013760
- Permissions
- rx
- Entropy
- 6.24
- Name
- .rdata
- Virtual address
- 1019904
- Virtual size
- 1142056
- Raw size
- 1142272
- Permissions
- r
- Entropy
- 6.03
- Name
- .data
- Virtual address
- 2162688
- Virtual size
- 360520
- Raw size
- 60416
- Permissions
- rw
- Entropy
- 4.53
- Name
- .pdata
- Virtual address
- 2527232
- Virtual size
- 20364
- Raw size
- 20480
- Permissions
- r
- Entropy
- 5.22
- Name
- .xdata
- Virtual address
- 2547712
- Virtual size
- 180
- Raw size
- 512
- Permissions
- r
- Entropy
- 1.78
5 shown
Imports1
1 DLL groups
- 1 import DLL groups
- 5+ imported functions summarized
View details · 1 shown
- Library
- kernel32.dll
- Functions
- AddVectoredContinueHandler, AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateIoCompletionPort, CreateThread, CreateWaitableTimerExW, DuplicateHandle …
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates1
1 issuer
- Example subject: easports.gg
- Issued by: easports.gg
- Validity period (UTC): 2026-07-30 – 2027-07-30
View details · 1 shown
- Subject
- easports.gg
- Issuer
- easports.gg
- Valid from
- 1785437580.0
- Valid to
- 1816973580.0
- Fingerprint
- 837D5001582208618FCE9113315ED6166C58CB0B