Report - dc5abf20ae0c…42e445d13a | VirusSign

Malicious CriticalFILE

Quota 38

First seen: 2026-10-02T12:59:57Z
Last seen: 2026-10-05T23:01:28Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYbladabinditrojan

RELATED INDICATORS3Connections in this report

ANALYSISMaliciousAging

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: dc5abf20ae0c61cb9de2ca80055d369872ef9b6be35fa7ebec386e42e445d13a
SHA1: 80324667cd1ac1f679f28e51a5954c8dae255a6b
MD5: a5f2e89d8926046fb4de161c78f79b6b
Filename: dc5abf20_[mr.abu hani].exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 23552
Compile time: 2026-10-01T10:09:35Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 3. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 92%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections92%

VirusSign confidence100%

Relationship context3 visible

Threat classificationbladabindi

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

3 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

1shown

72efe21de9a0561e405c4c804eaf166c2ac504d917bbdd548f2d40736da68b9e

0% 512 bytes contains

Filename 72efe21d_.text.bin MIME application/octet-stream Size 512 SHA1 5920690973c4561f349ec207187ba5a76bc31356 First seen 2020-08-16T13:14:46Z

Related IPs

Network IPs associated with this indicator.

1shown

81.71.128.221

20% medium CN communicates

CIDR 81.68.0.0/14 Network 81.68.0.0-81.71.255.255 First seen 2026-09-09T19:10:06Z Last seen 2026-11-13T11:47:04Z

Related domains

Domains associated with this indicator.

1shown

6.tcp.cpolar.cn

33% high .cn communicates

Root cpolar.cn TLD cn Subdomain 6.tcp First seen 2024-01-04T08:18:46Z Last seen 2026-11-13T11:47:08Z

Analysis details

Severity: criticaltrojanexeinput-checkdotnetobfuscatedpersistence

Freshness: Aging · Last seen 40 days ago.

Detection rate: 92%
Threat type: trojan
Family: bladabindi
Confidence: 100%
detection: 92 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: dc5abf20ae0c61cb9de2ca80055d369872ef9b6be35fa7ebec386e42e445d13a
SHA1: 80324667cd1ac1f679f28e51a5954c8dae255a6b
MD5: a5f2e89d8926046fb4de161c78f79b6b
Filename: dc5abf20_[mr.abu hani].exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 23552
Compile time: 2026-10-01T10:09:35Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T164B21A4E3FA98856C5AC1B74CAB5965003B491470413EE2FCDC560CBABB3AD92D4CEF9
SSDEEP: 384:2c68yCasVKDh3OQyNpsQ1im/VjJs+PyR46vg5J++p57nhmRvR6JZlbw8hqIusZzV:0873Kt+QesGN/VjZPQRpcnus
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2026-10-02T12:59:57Z
Last seen: 2026-10-05T23:01:28Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 3. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 92%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family bladabindi.

Relationship context

3 related indicators are shown across 3 relationship group(s).

Observation timeline

4 timestamped observations are arranged from 2020-08-16 to 2026-10-01. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 92%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 3 visible

3 relationship group(s) provide pivot and infrastructure context.

Threat classification bladabindi

Classification context: type trojan, family bladabindi.

Intelligence freshness Aging

Last seen 40 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: dc5abf20_[mr.abu hani].exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 23552
Compile time: 2026-10-01T10:09:35Z
PE platform: x86 32-bit
Entry point: 29870
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

input-checkobfuscatedpersistence

View details · 5 shown

.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Attempted to modify the Windows registry from dynamically allocated (unbacked) memory
Attempted to open, duplicate, or impersonate an access token from dynamically allocated (unbacked) memory, indicative of credential theft or lateral movement

5 shown

View MITRE ATT&CK details · 5 shown

T1027.002 — .NET source code contains potential unpacker
Tactics: TA0005
T1106 — .NET source code references suspicious native API functions
Tactics: TA0002
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005
T1112 · T1547 — Attempted to modify the Windows registry from dynamically allocated (unbacked) memory
Tactics: TA0003 · TA0004 · TA0112
T1071 · T1568 — Attempted to resolve a domain name from dynamically allocated (unbacked) memory
Tactics: TA0011

5 shown

View MBC details · 5 shown

E1010 — Application Window Discovery
Objectives: OB0007
C0026.001 · C0053.001 — Base64
Objectives: OC0004
Communication
Objectives: OC0006
C0024 — Compress Data
Objectives: OC0004
C0045 — Copy File
Objectives: OC0001

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity3

TCP, UDPports 14149, 53

3 outbound connections observed
0 domains, 2 IPs, 0 URLs
Common ports: 14149, 53
Protocols: TCP, UDP

View details · 3 shown

IP: 81.71.128.221
Port: 14149
Protocol: TCP

IP: 81.71.128.221
Port: 14149

IP: 162.159.36.2
Port: 53
Protocol: UDP

DNS request activity3

A5+ response IPs

3 DNS requests observed
3 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 3 shown

Query: 6.tcp.cpolar.cn
Type: A
Answers: 81.71.128.221
Response: NOERROR

Query: atm.teams.mira.tm.svc.cloud.microsoft
Type: A
Answers: 52.123.250.140, 52.123.250.177, 52.123.250.168, 52.123.250.134, 52.123.250.166, 52.123.250.180, 52.123.250.150, 52.123.250.138
Response: NOERROR

Query: a1672.dscr.akamai.net
Type: A
Answers: 23.55.236.138, 23.55.236.136
Response: NOERROR

C2 candidates3

DNS, TCPports 14149, 53

3 C2 candidate communications
1 domains, 1 IPs
Common ports: 14149, 53
Protocols: DNS, TCP

View details · 3 shown

IP: 81.71.128.221
Domain: 6.tcp.cpolar.cn
Port: 53
Protocol: DNS

IP: 81.71.128.221
Port: 14149
Protocol: TCP

IP: 81.71.128.221
Port: 14149

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2026-10-01T10:09:35Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 29870
Sections: 3
Compile time: 2026-10-01T10:09:35Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 21684
Raw size: 22016
Permissions: rx
Entropy: 5.58

Name: .rsrc
Virtual address: 32768
Virtual size: 16
Raw size: 512
Permissions: r
Entropy: 2.88

Name: .reloc
Virtual address: 40960
Virtual size: 12
Raw size: 512
Permissions: r
Entropy: 0.08

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.