Report - dcbbae5a1c61…84081c9b78

Malicious HighFILE

Quota 38

First seen: 2022-01-18T08:27:10Z
Last seen: 2026-04-29T08:33:02Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmsiltrojan

RELATED INDICATORS23Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
SHA1: 16525cb2fd86dce842107eb1ba6174b23f188537
MD5: 14c8482f302b5e81e3fa1b18a509289d
Filename: Trojan.Win32.WhisperGate.Stage2
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 214944
Compile time: 2022-01-10T14:39:54Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 23. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 88%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections88%

VirusSign confidence100%

Relationship context23 visible

Threat classificationmsil

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

23 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

3shown

6ab08bc281b15935876936423b906c2bd8772ab1a6cb67a8fed2116e506fb7f8

77% high zip 215178 bytes contains

Family msil Type trojan File type zip MIME application/zip Size 215178

a71c190a9a5d9d452058b52f7b38188ef4066af006845c952ba3d69b367672ba

76% high zip 139751916 bytes drops

Filename MalwareDatabase(NTFS123 Version).zip Family doubleagent Type trojan File type zip MIME application/zip

a2179da05e5b123debb8cd54d4ee0f46cd37703626dc1eaf4aa722a0d8dbc768

50% high isoimage 105736192 bytes contains

Filename Malware Collection.iso Family loveletter Type worm File type isoimage MIME application/x-iso9660-image

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

0ee291f2b35946c4b7c1c82b4f2b3798fdc3ecf91807929fa90ad4254f356ea4

0% 16388 bytes drops

Filename StartupProfileData-NonInteractive MIME application/octet-stream Size 16388 SHA1 40a37664a92412902879b93f20fb7960eec55f5a First seen 2024-03-27T17:16:58Z

0739bf03e195721440746f33c915cf6c4ebe9e429f6694c02b09de7c78a28b11

0% 512 bytes contains

Filename .reloc MIME application/octet-stream Size 512 SHA1 04cc258a9107dcaacd0dd1165347934883a17faf First seen 2020-08-26T21:14:22Z

0227a899085741c1d4d5afed100fd9d20cd73e02c8bb8374638bb4d145cb2588

0% pedll 5923152 bytes drops

Filename 87008171.exe File type pedll MIME application/vnd.microsoft.portable-executable Size 5923152 Compile time 2010-09-29T03:53:04Z

79b85600e4f470c2802776485dd6585219a5db29bb46f459e8f827b360e001c0

0% javascript 1962 bytes drops

Filename Stand.Launchpad.bat.exe.log File type javascript MIME application/javascript Size 1962 SHA1 3def8af65e0d3f34562161ac354bb6c3882d53f4

a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

0% 64 bytes drops

Filename startupprofiledata-noninteractive MIME application/octet-stream Size 64 SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799 First seen 2014-08-19T15:29:21Z

Related IPs

Network IPs associated with this indicator.

5shown

104.86.182.43

0% US communicates

CIDR 104.86.176.0/21 Network 104.64.0.0-104.127.255.255 First seen 2023-09-29T19:26:24Z Last seen 2026-11-12T16:34:01Z

23.216.147.78

0% US communicates

CIDR 23.216.144.0/21 Network 23.192.0.0-23.223.255.255 First seen 2026-08-22T23:41:45Z Last seen 2026-11-13T02:10:46Z

20.62.24.77

0% US communicates

CIDR 20.48.0.0/12 Network 20.33.0.0-20.128.255.255 First seen 2023-10-02T05:04:45Z Last seen 2026-11-12T15:31:21Z

192.168.0.59

0% communicates

First seen 2022-11-20T10:06:10Z Last seen 2026-11-13T02:10:07Z

131.253.33.203

0% US communicates

CIDR 131.253.33.0/24 Network 131.253.21.0-131.253.47.255 First seen 2023-09-29T18:47:42Z Last seen 2026-11-13T02:05:26Z

Related domains

Domains associated with this indicator.

5shown

ax-0001.ax-msedge.net

0% .net communicates

Root ax-msedge.net TLD net Subdomain ax-0001 First seen 2024-05-05T17:04:48Z Last seen 2026-11-12T18:09:24Z

crt.sectigo.com

0% .com communicates

Root sectigo.com TLD com Subdomain crt First seen 2023-09-30T15:21:00Z Last seen 2026-11-13T01:43:25Z

82.250.63.168.in-addr.arpa

0% .in-addr.arpa communicates

Root 168.in-addr.arpa TLD in-addr.arpa Subdomain 82.250.63 First seen 2026-08-16T14:42:26Z Last seen 2026-11-12T09:46:48Z

e8652.dscx.akamaiedge.net

0% .net communicates

Root akamaiedge.net TLD net Subdomain e8652.dscx First seen 2023-09-29T09:46:51Z Last seen 2026-11-13T02:10:53Z

crl.root-x1.letsencrypt.org.edgekey.net

0% .net communicates

Root edgekey.net TLD net Subdomain crl.root-x1.letsencrypt.org First seen 2023-09-30T08:49:01Z Last seen 2026-11-13T02:10:53Z

Related URLs

URLs associated with this indicator.

5shown

https://cdn.discordapp.com/attachments/928503440139771947/930108637681184768…

13% critical communicates

TLD com HTTP status 404 Content length 36 Content SHA256 c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65 First seen 2022-01-15T19:43:53Z

http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt

0% communicates

TLD com HTTP status 200 Content length 1499 Content SHA256 e8e95f0733a55e8bad7be0a1413ee23c51fcea64b3c8fa6a786935fddcc71961 First seen 2014-12-30T02:03:46Z

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt

0% communicates

TLD com HTTP status 200 Content length 1547 Content SHA256 4f987bbe4e0d1dcf48fcefc9239ac6e62ee9df38cac2d32993b8533cd95c2e49 First seen 2014-01-24T17:20:22Z

http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt

0% communicates

TLD com HTTP status 200 Content length 1472 Content SHA256 9cbf22fae0dd53a7395556ce6154aa14a0d03360aa8c51cfea05d1fd8819e043 First seen 2014-07-14T13:04:05Z

http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c

0% communicates

TLD com HTTP status 200 Content length 4515 Content SHA256 73233f5d24a81d97e37f94f67d3a3ad70dd76379cdef1918b6ff3069a958b829 First seen 2021-06-29T03:17:22Z

Analysis details

Severity: hightrojanexec-delaydynamic-loadingfile-overlaydebug-checkadapter-discoveryexecpu-clockdotnetinvalid-signatureenv-checksigned

Freshness: Historical · Last seen 197 days ago.

Detection rate: 88%
Threat type: trojan
Family: msil
Confidence: 100%
detection: 88 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
SHA1: 16525cb2fd86dce842107eb1ba6174b23f188537
MD5: 14c8482f302b5e81e3fa1b18a509289d
Filename: Trojan.Win32.WhisperGate.Stage2
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 214944
Compile time: 2022-01-10T14:39:54Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T14624A00CE1CFD341E5AC55B082E2DA89EEE9EFE8541883C9A1D1F6B936F365A7530107
SSDEEP: 3072:vf1GlJZUnjNbGgNQfYySIHiP1WLz4PcSOvG2jxZ:FbGoJ8iP19PjmGyf
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2022-01-18T08:27:10Z
Last seen: 2026-04-29T08:33:02Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 23. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 88%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family msil.

Relationship context

23 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

24 timestamped observations are arranged from 2010-09-29 to 2026-08-22. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 88%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 23 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification msil

Classification context: type trojan, family msil.

Intelligence freshness Historical

Last seen 197 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: Trojan.Win32.WhisperGate.Stage2
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 214944
Compile time: 2022-01-10T14:39:54Z
PE platform: x86 32-bit
Entry point: 24910
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

env-checkadapter-discoverydebug-checkcpu-clockexec-delaydynamic-loading

View details · 5 shown

.NET source code contains potential unpacker
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains paths to debug symbols
Checks if the current process is being debugged

5 shown

View MITRE ATT&CK details · 5 shown

T1027.002 — .NET source code contains potential unpacker
Tactics: TA0005
T1518.001 — AV process strings found (often used to terminate AV products)
Tactics: TA0007
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007
T1059 — Command and Scripting Interpreter
Tactics: TA0002

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
C0008 — Change Memory Protection
Objectives: OC0002
B0009.005 — Check Registry Keys
Objectives: OB0001
E1059 — Command and Scripting Interpreter
Objectives: OB0009
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDP, HTTPports 443, 53, 80

5+ outbound connections observed
3 domains, 5+ IPs, 5+ URLs
Common ports: 443, 53, 80, 137
Protocols: TCP, UDP, HTTP

View details · 5 shown

Domain: cdn.discordapp.com
URL: https://cdn.discordapp.com/attachments/928503440139771947/930108637681184768/tbopbh.jpg
Protocol: HTTP

IP: 13.107.4.50
Port: 80
Protocol: TCP

Domain: www.microsoft.com
URL: http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt
Protocol: HTTP

Domain: www.microsoft.com
URL: http://www.microsoft.com/pki/certs/microsofttimestamppca.crt
Protocol: HTTP

Domain: www.microsoft.com
URL: http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: x1.c.lencr.org

Query: www.msn.com

Query: www.microsoft.com
Type: A
Answers: 104.71.214.69, 23.55.140.42, 23.216.81.152
Response: NOERROR

Query: www.microsoft.com
Type: A
Answers: 23.55.140.42
Response: NOERROR

Query: svc.ha-teams.office.com

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2022-01-10T14:39:54Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 24910
Sections: 3
Compile time: 2022-01-10T14:39:54Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 16724
Raw size: 16896
Permissions: rx
Entropy: 5.88

Name: .rsrc
Virtual address: 32768
Virtual size: 147736
Raw size: 147968
Permissions: r
Entropy: 3.55

Name: .reloc
Virtual address: 188416
Virtual size: 12
Raw size: 512
Permissions: r
Entropy: 0.08

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION

View details · 4 shown

Type: RT_ICON
Language: NEUTRAL

Type: RT_GROUP_ICON
Language: NEUTRAL

Type: RT_VERSION
Language: NEUTRAL

Type: RT_MANIFEST
Language: NEUTRAL

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

3 issuers

Example subject: Microsoft Windows
Issued by: Microsoft Windows Production PCA 2011
Validity period (UTC): 2020-12-15 – 2021-12-02

View details · 5 shown

Subject: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011
Valid from: 1608067740.0
Valid to: 1638480540.0
Fingerprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A

Subject: Microsoft Windows Production PCA 2011
Issuer: Microsoft Root Certificate Authority 2010
Valid from: 1319049660.0
Valid to: 1792435860.0
Fingerprint: 580A6F4CC4E4B669B9EBDC1B2B3E087B80D0678D

Subject: Microsoft Root Certificate Authority 2010
Issuer: Microsoft Root Certificate Authority 2010
Valid from: 1277330220.0
Valid to: 2066249040.0
Fingerprint: 3B1EFD3A66EA28B16697394703A72CA340A05BD5

Subject: Microsoft Time-Stamp Service
Issuer: Microsoft Time-Stamp PCA 2010
Fingerprint: 0D4D94FE1BDE96848D743F1DEE4A04C6B3658C07

Subject: Microsoft Time-Stamp PCA 2010
Issuer: Microsoft Root Certificate Authority 2010
Fingerprint: 2AA752FE64C49ABE82913C463529CF10FF2F04EE

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check