Report - deb9fa9accc7…813dfbbe0d

No detections FILE

Quota 44

First seen: 2019-05-02T11:57:38Z
Last seen: 2026-05-12T08:12:32Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS16Connections in this report

ANALYSISNo detectionsHistorical

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: deb9fa9accc740cd6a0cfb135e7036c45737ae5234713abce690b9813dfbbe0d
SHA1: cdf7c6ae91aacfd87b7cd237e02b9e940f3e1e3e
MD5: 242ccad579f43807f60c5e76da229f4a
Filename: F1FA-13 (1).exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3885920
Compile time: 2013-12-01T08:08:28Z
PE platform: x86 32-bit
PE sections: 4

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context16 visible

Intelligence freshnessHistorical

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

acaaf17f5a98c406890d778cfa0e7ebfb93532f1e69f2e965f01d3de8fb82f1c

0% bittorrent 31222 bytes contains

Filename FIFA 13 =FIFA Soccer 13= PC full game ^^nosTEAM^^.torrent File type bittorrent MIME application/x-bittorrent Size 31222 SHA1 21e16eff1cdfbd6878d132abb36a64687fad3eef

71bfe8efdcee8f092490abb0980a26b9b0b5415a4791abffee4bdb19348b497c

0% 417 bytes contains

Filename update-fifa13.bat MIME application/x-msdos-program Size 417 SHA1 287e4ecd9bd83e889bbd4bb666c5b07c0269a558 First seen 2016-04-18T20:54:37Z

3278f3ff732ee4f95186d972bb51b17c1be55431f50031df6be8ef3b30b683d4

0% html 3153 bytes contains

Filename file-5621508_html File type html MIME text/html Size 3153 SHA1 f8a68b420c97718f901bc389c832852dd6ead68a

d29e033c40dc6383ab52823f559934279326596b62f9c44690d27da843a39d18

0% bmp 3661894 bytes contains

Filename nosTEAM File type bmp MIME application/octet-stream Size 3661894 SHA1 584e3dc56746d8df3a50f35ae0d4bfae2a400d3d

4c31393ce8ae5ea969a049b3ff5dd0ea18e6c29e0e59841bec1d7afb7c64de4c

0% text 380 bytes drops

Filename 5O0LQCB1D1pzA6tUVcKIuUC57kVDOb.txt File type text MIME text/plain Size 380 SHA1 3ea8fdd98aa9f20167008f57daa6f8ed3eca9738

Related IPs

Network IPs associated with this indicator.

5shown

173.194.195.100

0% US communicates

CIDR 173.194.0.0/16 Network 173.194.0.0-173.194.255.255 First seen 2023-09-30T19:37:53Z Last seen 2026-11-13T09:10:30Z

142.251.183.138

5% low US communicates

CIDR 142.250.0.0/15 Network 142.250.0.0-142.251.255.255 First seen 2024-04-25T21:34:08Z Last seen 2026-11-13T09:10:28Z

216.239.38.181

5% low US communicates

CIDR 216.239.32.0/20 Network 216.239.32.0-216.239.63.255 First seen 2023-09-29T12:43:08Z Last seen 2026-11-13T07:30:57Z

216.239.36.181

5% low US communicates

CIDR 216.239.32.0/20 Network 216.239.32.0-216.239.63.255 First seen 2023-09-29T15:49:38Z Last seen 2026-11-13T07:30:57Z

216.239.34.181

5% low US communicates

CIDR 216.239.32.0/20 Network 216.239.32.0-216.239.63.255 First seen 2023-10-01T06:23:11Z Last seen 2026-11-13T07:30:57Z

Related domains

Domains associated with this indicator.

5shown

js.hs-scripts.com

0% .com communicates

Root hs-scripts.com TLD com Subdomain js First seen 2023-09-30T16:17:13Z Last seen 2026-11-12T22:22:31Z

bat.bing.com

0% .com communicates

Root bing.com TLD com Subdomain bat First seen 2023-09-29T19:27:23Z Last seen 2026-11-13T08:46:25Z

cdn.livechatinc.com

0% .com communicates

Root livechatinc.com TLD com Subdomain cdn First seen 2023-10-01T10:11:58Z Last seen 2026-11-12T15:35:50Z

api.livechatinc.com

0% .com communicates

Root livechatinc.com TLD com Subdomain api First seen 2023-09-29T06:38:26Z Last seen 2026-11-12T14:25:07Z

static.hotjar.com

0% .com communicates

Root hotjar.com TLD com Subdomain static First seen 2023-09-29T16:03:04Z Last seen 2026-11-12T22:14:24Z

Related URLs

URLs associated with this indicator.

1shown

http://e5.i.lencr.org/

0% communicates

TLD org HTTP status 200 Content length 1115 Content SHA256 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb First seen 2024-06-13T00:50:48Z

Analysis details

exec-delayfile-overlayexeinput-checkcpu-clockdynamic-loading

Freshness: Historical · Last seen 185 days ago.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: deb9fa9accc740cd6a0cfb135e7036c45737ae5234713abce690b9813dfbbe0d
SHA1: cdf7c6ae91aacfd87b7cd237e02b9e940f3e1e3e
MD5: 242ccad579f43807f60c5e76da229f4a
Filename: F1FA-13 (1).exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 3885920
Compile time: 2013-12-01T08:08:28Z
PE platform: x86 32-bit
PE sections: 4
Import libraries: 9
TLSH: T19406F985AFB1F53ADABC0B30CCB54ACD2626BDA00D7392CF562978745F72BA1DE41520
SSDEEP: 3072:9bHZEXb+0peSIfznvO4O+lu/IRD68wb2kyZtXYSI7zxHvuGZ2ugzdRHznfNrNN7a:lHZL/SIftE/qD68waG17R4X7zfL395IZ
Imphash: cb23e26cc45ed9aa58fdce155e7da31a
Richhash: cd0425052a1b4fa91123eb49b8f1b19e
First seen: 2019-05-02T11:57:38Z
Last seen: 2026-05-12T08:12:32Z
Filename variants: 2 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2012-09-18 to 2024-06-13. These are observation or metadata times, not execution order.

Infrastructure geography

5 infrastructure/location point(s) are visible on the map.

Intelligence freshness

Last seen 185 days ago. Revalidate volatile infrastructure before enforcement.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Historical

Last seen 185 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: F1FA-13 (1).exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 3885920
Compile time: 2013-12-01T08:08:28Z
PE platform: x86 32-bit
Entry point: 67759
Sections: 4

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

input-checkcpu-clockexec-delaydynamic-loading

View details · 5 shown

A ping command was executed with the -n argument possibly to delay analysis
Checks available memory
Checks system language via registry key (possible geofencing)
Dynamic (imported) function loading detected
Possible date expiration check, exits too soon after checking local time

5 shown

View MITRE ATT&CK details · 5 shown

T1071 — A ping command was executed with the -n argument possibly to delay analysis
Tactics: TA0011
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007
T1082 — Checks available memory
Tactics: TA0007
T1055 — Creates a process in suspended mode (likely to inject code)
Tactics: TA0004 · TA0005
T1036 — Creates files inside the user directory
Tactics: TA0005

5 shown

View MBC details · 5 shown

C0040 — Allocate Thread Local Storage
Objectives: OC0003
Anti-Behavioral Analysis
Objectives: OB0001
E1010 — Application Window Discovery
Objectives: OB0007
F0013 — Bootkit
Objectives: OB0006 · OB0012
C0032.001 — CRC32
Objectives: OC0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDP, HTTPports 443, 80

5+ outbound connections observed
1 domains, 5+ IPs, 1 URLs
Common ports: 443, 80
Protocols: TCP, UDP, HTTP

View details · 5 shown

IP: 216.239.32.181
Port: 443
Protocol: TCP

Domain: e5.i.lencr.org
URL: http://e5.i.lencr.org/
Protocol: HTTP

IP: 89.40.214.121
Port: 443
Protocol: TCP

IP: 89.187.180.101
Port: 443
Protocol: TCP

IP: 57.144.216.128
Port: 443
Protocol: TCP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: ib.adnxs.com
Type: A
Answers: 104.254.150.241, 104.254.148.252, 104.254.151.68, 104.254.151.69, 104.254.148.251, 104.254.151.60, 104.254.151.36
Response: NOERROR

Query: edge-consumer-static.azureedge.net

Query: clients2.googleusercontent.com
Type: A
Answers: 209.85.200.132
Response: NOERROR

Query: xpaywalletcdn.azureedge.net

Query: www.redditstatic.com
Type: A
Answers: 146.75.77.140
Response: NOERROR

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit4 sections

Platform: x86 32-bit
Sections: 4
Entry point: present
Compile time: 2013-12-01T08:08:28Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 67759
Sections: 4
Compile time: 2013-12-01T08:08:28Z

PE sections4

4 sections

4 PE sections
Common permissions: r, rw, rx
4 unique section names

View details · 4 shown

Name: .text
Virtual address: 4096
Virtual size: 100282
Raw size: 100352
Permissions: rx
Entropy: 6.65

Name: .rdata
Virtual address: 106496
Virtual size: 17715
Raw size: 17920
Permissions: r
Entropy: 5.32

Name: .data
Virtual address: 126976
Virtual size: 196136
Raw size: 4608
Permissions: rw
Entropy: 2.35

Name: .rsrc
Virtual address: 323584
Virtual size: 64492
Raw size: 64512
Permissions: r
Entropy: 4.27

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: COMCTL32.dll
Functions: InitCommonControlsEx

Library: SHLWAPI.dll
Functions: SHAutoComplete

Library: KERNEL32.dll
Functions: CloseHandle, CompareStringW, CreateDirectoryW, CreateFileA, CreateFileMappingW, CreateFileW, DeleteCriticalSection, DeleteFileW …

Library: USER32.dll
Functions: CharToOemA, CharUpperW, CopyRect, CreateWindowExW, DefWindowProcW, DestroyIcon, DestroyWindow, DialogBoxParamW …

Library: GDI32.dll
Functions: CreateCompatibleBitmap, CreateCompatibleDC, DeleteDC, DeleteObject, GetDeviceCaps, GetObjectW, SelectObject, StretchBlt

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, RT_STRING, RT_DIALOG, RT_BITMAP, RT_GROUP_ICON

View details · 5 shown

Type: RT_BITMAP
Language: NEUTRAL DEFAULT

Type: RT_ICON
Language: NEUTRAL DEFAULT

Type: RT_DIALOG
Language: ENGLISH US

Type: RT_STRING
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: NEUTRAL DEFAULT

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check