Report - dd38d747f7c8…25f6ff7a4c

Malicious CriticalFILE

Quota 36

First seen: 2022-12-23T14:26:23Z
Last seen: 2022-12-31T18:23:05Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYpioneermalware

RELATED INDICATORS18Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: dd38d747f7c8205493bd9c8157791b3903bc607ce03331647dfa4a25f6ff7a4c
SHA1: b1aa326f3434a06e1e23b94715bd6707c9f812fb
MD5: 3a6ec7006fb9a8fc87e7d898ac38ea5d
Filename: install-filter.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 727495
Compile time: 2020-07-24T03:08:27Z
PE platform: x86 32-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 83%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections83%

VirusSign confidence100%

Relationship context18 visible

Threat classificationpioneer

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

18 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

5660ffe1b87333746b5c33ccf4f0f42967fde2d134933d8443bdf676c996b5de

5% high peexe 3611136 bytes drops

Filename frida-helper-32.exe Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 3611136

31c94074d1a479e9b2360a65610603415e5c50ebb7e0b0871b0a063a75854ac1

8% low pedll 17223680 bytes drops

Filename frida-agent.dll Type malware File type pedll MIME application/vnd.microsoft.portable-executable Size 17223680

1231d2117cccfa30cb2d52a3fcabd8c9ccefc82d1a917d75d4bfbc9bee88c1ba

0% text 4085 bytes drops

Filename 5) install-filter-help.txt File type text MIME text/plain Size 4085 SHA1 f3823aab42d57006f4c80dd32d39168313b2c13e

8ea45a1b88dfd819f0ada3af36d464e1bf52574269592370e0cc8d0490680e1f

4% low peexe 81088 bytes drops

Filename armsvc.exe (copy) Family expiro File type peexe MIME application/vnd.microsoft.portable-executable Size 81088

de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

92% high pedll 69337 bytes drops

Filename dlcoer.dll Family floxif Type trojan File type pedll MIME application/vnd.microsoft.portable-executable

Related IPs

Network IPs associated with this indicator.

5shown

10.8.0.13

0% communicates

First seen 2022-09-22T12:09:16Z Last seen 2026-10-27T03:42:44Z

10.8.0.12

0% communicates

First seen 2022-12-10T09:05:11Z Last seen 2026-11-10T21:45:30Z

10.8.0.11

0% communicates

First seen 2022-11-25T20:23:31Z Last seen 2026-10-27T03:42:44Z

10.8.0.10

0% communicates

First seen 2022-12-06T11:59:23Z Last seen 2026-10-27T03:42:44Z

209.197.3.8

11% high US communicates

CIDR 209.197.0.0/19 Network 209.197.0.0-209.197.31.255 First seen 2023-09-30T21:27:37Z Last seen 2026-11-13T03:12:18Z

Related domains

Domains associated with this indicator.

3shown

5isohu.com

29% critical .com communicates

Root 5isohu.com TLD com First seen 2023-09-30T00:49:45Z Last seen 2026-11-13T04:10:53Z

aieov.com

20% high .com communicates

Root aieov.com TLD com First seen 2023-09-30T15:14:32Z Last seen 2026-11-13T04:10:53Z

www.aieov.com

19% high .com communicates

Root aieov.com TLD com Subdomain www First seen 2023-09-30T12:31:38Z Last seen 2026-11-13T04:10:53Z

Related URLs

URLs associated with this indicator.

5shown

http://23.195.81.16/

0% communicates

HTTP status 400 Content length 207 Content SHA256 dbc2a256f64b942230d70ee857dfa3f76d99ad1188c20a2d3d32bda020aa7710 First seen 2022-11-17T22:46:12Z Last seen 2026-06-30T21:18:06Z

http://10.8.0.110/

0% communicates

First seen 2014-10-04T21:31:02Z Last seen 2026-10-27T03:40:43Z

http://10.8.0.124/

0% communicates

First seen 2020-06-15T17:01:35Z Last seen 2026-10-01T02:23:38Z

http://10.8.0.3/

0% communicates

First seen 2016-02-29T19:29:59Z Last seen 2026-10-27T03:42:41Z

http://10.8.0.17/

0% communicates

First seen 2018-02-14T13:53:16Z Last seen 2026-10-27T03:42:44Z

Analysis details

Severity: criticalmalwareexefile-overlaycpu-clockexec-delaydynamic-loadingdebug-checkcve-2000-0778exploit

Freshness: Historical · Last seen 1412 days ago.

Detection rate: 83%
Threat type: malware
Family: pioneer
Confidence: 100%
detection: 83 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: dd38d747f7c8205493bd9c8157791b3903bc607ce03331647dfa4a25f6ff7a4c
SHA1: b1aa326f3434a06e1e23b94715bd6707c9f812fb
MD5: 3a6ec7006fb9a8fc87e7d898ac38ea5d
Filename: install-filter.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 727495
Compile time: 2020-07-24T03:08:27Z
PE platform: x86 32-bit
PE sections: 6
Import libraries: 5
TLSH: T148F46E00B250C13CF8F31176A6BEC668B8397A34176C51CBF3D56ADA5B689E1AC31B17
SSDEEP: 12288:EhMrzi+ePPYQmwPJKoXc8SM64DNRoXPirgSKWAuqTBjvrEH77:eMHi+MPUgSp4DNv0ZJrEH77
Imphash: ebd7bf94ae734e14b3a3f80f028c7bf4
Richhash: 71230425801933abb3b04ac7d10a05f0
First seen: 2022-12-23T14:26:23Z
Last seen: 2022-12-31T18:23:05Z
Filename variants: 2 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 83%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type malware and family pioneer.

Relationship context

18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

19 timestamped observations are arranged from 2012-12-06 to 2023-09-30. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 83%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 18 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification pioneer

Classification context: type malware, family pioneer.

Intelligence freshness Historical

Last seen 1412 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: install-filter.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 727495
Compile time: 2020-07-24T03:08:27Z
PE platform: x86 32-bit
Entry point: 88592
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkcpu-clockexec-delaydynamic-loading

View MITRE ATT&CK details · 5 shown

T1036 — Creates files inside the program directory
Tactics: TA0005
T1071 — Detected HTTP requests to some non white-listed domains
Tactics: TA0011
T1140 — Detected an attempt to pull out some data from the binary image
Tactics: TA0005
T1105 — Drops interesting files and uses them
Tactics: TA0011
T1063 — It Tries to detect injection methods
Tactics: TA0007

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 53, 443, 80

5+ outbound connections observed
5+ domains, 4 IPs, 5+ URLs
Common ports: 53, 443, 80
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: www.aieov.com
URL: http://www.aieov.com/logo.gif
Protocol: HTTP

Domain: 5isohu.com
URL: http://5isohu.com/logo.gif
Protocol: HTTP

IP: 45.56.79.23
Port: 80
Protocol: TCP

IP: 8.8.8.8
Port: 53
Protocol: UDP

Domain: 23.195.81.16
URL: http://23.195.81.16/
Protocol: HTTP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
4 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: www.aieov.com
Type: A
Answers: 173.255.194.134, 45.33.23.183, 45.33.2.79, 96.126.123.244, 45.33.18.44, 72.14.178.174, 72.14.185.43, 45.79.19.196 …
Response: NOERROR

Query: www.aieov.com
Type: A
Answers: 45.33.20.235
Response: NOERROR

Query: 5isohu.com

Query: 23.195.81.16
Type: A
Answers: 23.195.81.16
Response: NOERROR

Query: 209.197.3.8
Type: A
Answers: 209.197.3.8
Response: NOERROR

C2 candidates4

DNS, HTTPports 53

4 C2 candidate communications
2 domains, 2 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 4 shown

Domain: www.aieov.com
Protocol: HTTP

Domain: 5isohu.com
Protocol: HTTP

IP: 45.33.20.235
Domain: www.aieov.com
Port: 53
Protocol: DNS

IP: 198.58.118.167
Domain: www.aieov.com
Port: 53
Protocol: DNS

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5+ sections

Platform: x86 32-bit
Sections: 5+
Entry point: present
Compile time: 2020-07-24T03:08:27Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 88592
Sections: 6
Compile time: 2020-07-24T03:08:27Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 503311
Raw size: 503808
Permissions: rx
Entropy: 5.64

Name: .rdata
Virtual address: 507904
Virtual size: 101001
Raw size: 101376
Permissions: r
Entropy: 3.64

Name: .data
Virtual address: 610304
Virtual size: 16992
Raw size: 6656
Permissions: rw
Entropy: 3.08

Name: .idata
Virtual address: 630784
Virtual size: 6307
Raw size: 6656
Permissions: rw
Entropy: 4.74

Name: .rsrc
Virtual address: 638976
Virtual size: 6665
Raw size: 7168
Permissions: r
Entropy: 4.09

5 shown

Imports5

5 DLL groups

5 import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: ADVAPI32.dll
Functions: AllocateAndInitializeSid, CheckTokenMembership, FreeSid, RegCloseKey, RegDeleteValueA, RegEnumKeyExA, RegOpenKeyExA, RegQueryValueExA …

Library: KERNEL32.dll
Functions: AreFileApisANSI, CloseHandle, CompareStringW, CreateFileW, CreateSemaphoreA, CreateSemaphoreW, CreateThread, DecodePointer …

Library: SETUPAPI.dll
Functions: CM_Get_Device_IDA, CM_Get_DevNode_Status, SetupCloseInfFile, SetupDiCallClassInstaller, SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA, SetupDiGetDeviceInstallParamsA …

Library: GDI32.dll
Functions: BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, CreateSolidBrush, DeleteDC, DeleteObject, SelectObject

Library: USER32.dll
Functions: CreateWindowExA, DefWindowProcA, DestroyWindow, DispatchMessageA, DrawEdge, EnableWindow, FillRect, GetClassInfoExA …

Resources2

2 resources

2 resources
Resource types: RT_VERSION, Struct(300)

View details · 2 shown

Type: RT_VERSION
Language: ENGLISH US

Type: Struct(300)
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check