Report - def46aa6a8f7…4b3e1fa4cb

No detections FILE

Quota 48

First seen: 2025-11-25T21:59:58Z
Last seen: 2026-11-14T15:25:18Z

THREAT SIGNALBenign VirusSign assessment

CONFIDENCENot providedVirusSign analysis

FAMILYNot identifiedMalware classification

RELATED INDICATORS14Connections in this report

ANALYSISNo detectionsFresh

Indicator overview

INDICATOR PROFILE

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

SHA256: def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
SHA1: a51032ec39a292afda65b0e3053d4ff3e3241512
MD5: 4e3fa9bd90ef020c14359639dc19312b
Filename: def46aa6_qazx2o5h.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 553552
Compile time: 2056-12-30T02:28:45Z
PE platform: x64 64-bit
PE sections: 6

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

14 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Analysis signals

OBSERVED

Engine detections0%

Relationship context14 visible

Intelligence freshnessFresh

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

14 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

ffd475522af6e749057b5179dd1b85d38361a8ac46d2577aacb83e7a758560eb

9% high peexe 22483456 bytes drops

Filename ffd47552_ethereum gas tracker 0.9.6.bin Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 22483456

eea9a45f86bb9d45bb409f7d46963282fced255efa21425c3bef39bdeb4eaab3

8% low peexe 25113088 bytes drops

Filename eea9a45f_arsen.bin File type peexe MIME application/vnd.microsoft.portable-executable Size 25113088 Compile time 2025-11-29T11:00:24Z

ee92be7f1019bf953b04b578f756fd57fc98ce5acce77ffa1c525d8b1aca5a57

8% low peexe 25250304 bytes drops

Filename ee92be7f_arsen.bin Type malware File type peexe MIME application/vnd.microsoft.portable-executable Size 25250304

e53597ecb9248afba277755b600596655b4e04184785bb02cdf52dad7c4e48ab

21% critical peexe 39689728 bytes drops

Filename e53597ec_macro_runner.bin Family python Type pua File type peexe MIME application/vnd.microsoft.portable-executable

b6551184a0554363dc592909d86c5225041a3b2239aeb176bee5dfc3e262c211

8% high peexe 31769600 bytes drops

Filename b6551184_ethereum gas tracker 0.9.6.bin Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 31769600

Dropped / child files

Files dropped, bundled, or created by the queried file.

3shown

0a382173eff3fb4e9e9c0476cf4a5d7a807846c710141ddaeb1cb82643df156c

0% 320668 bytes contains

Filename 0a382173_.text.bin MIME application/octet-stream Size 320668 SHA1 fdb4b1ad1ad5b507c5da9a70bfd6ef9aa54a5f0a First seen 2026-02-20T05:53:48Z

be222d99318db24d30d3419f441e1b31a7d812ed2a7b6ef487b9f727e3b86c61

0% 20560 bytes contains

Filename be222d99_certificate.bin MIME application/octet-stream Size 20560 SHA1 6e30ee8d7283c9fde07176216c86980d97dfcea1 First seen 2026-02-20T05:53:48Z

93489c91ff59edcb944cc33ebd10b5a4b89a32f75fb0f790fc8d2f70ab7f6724

0% 1608 bytes contains

Filename 93489c91_version.txt.bin MIME text/plain Size 1608 SHA1 b8dc11b1bf70d84ab28653125327a962fe60886c First seen 2026-02-20T13:17:04Z

Related IPs

Network IPs associated with this indicator.

3shown

135.233.45.222

0% US communicates

CIDR 135.224.0.0/12 Network 135.233.0.0-135.233.255.255 First seen 2025-07-12T05:24:13Z Last seen 2026-11-14T16:36:23Z

23.195.81.72

0% US communicates

CIDR 23.195.80.0/20 Network 23.192.0.0-23.223.255.255 First seen 2024-05-25T07:26:03Z Last seen 2026-11-14T17:08:19Z

23.195.81.59

0% US communicates

CIDR 23.195.80.0/20 Network 23.192.0.0-23.223.255.255 First seen 2024-05-26T01:02:41Z Last seen 2026-11-14T17:08:34Z

Related domains

Domains associated with this indicator.

3shown

assets.msn.com-ion.edgesuite.net

0% .net communicates

Root edgesuite.net TLD net Subdomain assets.msn.com-ion First seen 2025-06-07T15:22:23Z Last seen 2026-11-14T17:10:12Z

assets.msn.com

0% .com communicates

Root msn.com TLD com Subdomain assets First seen 2023-09-29T01:39:51Z Last seen 2026-11-14T17:10:18Z

a1666.dscr.akamai.net

0% .net communicates

Root akamai.net TLD net Subdomain a1666.dscr First seen 2024-08-06T21:27:17Z Last seen 2026-11-14T17:10:12Z

Analysis details

64bitfile-overlaydllknownsrcdebug-checklegitsigned

Freshness: Fresh · Last seen today.

Detection rate: 0%
detection: 0 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
SHA1: a51032ec39a292afda65b0e3053d4ff3e3241512
MD5: 4e3fa9bd90ef020c14359639dc19312b
Filename: def46aa6_qazx2o5h.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 553552
Compile time: 2056-12-30T02:28:45Z
PE platform: x64 64-bit
PE sections: 6
Import libraries: 14
TLSH: T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
SSDEEP: 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
Imphash: 98261f6662fee22446967eaa5226ee3a
Richhash: 46f756f897c82cc1495f09993915d1ec
First seen: 2025-11-25T21:59:58Z
Last seen: 2026-11-14T15:25:18Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

No detections were reported by the available engines. Review related indicators for additional context.

Detection signal

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context

14 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

15 timestamped observations are arranged from 2023-09-29 to 2056-12-30. These are observation or metadata times, not execution order.

Infrastructure geography

3 infrastructure/location point(s) are visible on the map.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.

Engine detections 0%

Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.

Relationship context 14 visible

4 relationship group(s) provide pivot and infrastructure context.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: def46aa6_qazx2o5h.bin
File type: pedll
MIME: application/vnd.microsoft.portable-executable
Size: 553552
Compile time: 2056-12-30T02:28:45Z
PE platform: x64 64-bit
Entry point: 316512
Sections: 6

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-check

View details · 5 shown

AV process strings found (often used to terminate AV products)
At least one IP Address, Domain, or File Name was found in a crypto call
Binary compilation timestomping detected
Binary contains a suspicious time stamp
Binary contains paths to debug symbols

5 shown

View MITRE ATT&CK details · 5 shown

T1071 — At least one IP Address, Domain, or File Name was found in a crypto call
Tactics: TA0011
T1070.006 — Binary compilation timestomping detected
Tactics: TA0005
T1082 — Checks available memory
Tactics: TA0007
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007
T1057 — Enumerates the modules from a process (may be used to locate base addresses in process injection)
Tactics: TA0007

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
B0009.005 — Check Registry Keys
Objectives: OB0001
Communication
Objectives: OC0006
C0045 — Copy File
Objectives: OC0001
C0038 — Create Thread
Objectives: OC0003

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity1

TCPports 443

1 outbound connections observed
0 domains, 1 IPs, 0 URLs
Common ports: 443
Protocols: TCP

View details · 1 shown

IP: 135.233.45.222
Port: 443
Protocol: TCP

DNS request activity3

A2 response IPs

3 DNS requests observed
3 unique queries
2 response IPs
Query types: A
Response codes: NOERROR

View details · 3 shown

Query: assets.msn.com-ion.edgesuite.net

Query: assets.msn.com
Type: A
Answers: 23.195.81.72, 23.195.81.59
Response: NOERROR

Query: a1666.dscr.akamai.net
Type: A
Answers: 23.195.81.72, 23.195.81.59
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2056-12-30T02:28:45Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 316512
Sections: 6
Compile time: 2056-12-30T02:28:45Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 320668
Raw size: 321024
Permissions: rx
Entropy: 6.35

Name: .rdata
Virtual address: 327680
Virtual size: 184594
Raw size: 184832
Permissions: r
Entropy: 5.63

Name: .data
Virtual address: 516096
Virtual size: 13040
Raw size: 7680
Permissions: rw
Entropy: 3.89

Name: .pdata
Virtual address: 532480
Virtual size: 14760
Raw size: 14848
Permissions: r
Entropy: 5.58

Name: .rsrc
Virtual address: 548864
Virtual size: 960
Raw size: 1024
Permissions: r
Entropy: 3.19

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: VCRUNTIME140.dll
Functions: __AdjustPointer, __C_specific_handler, __current_exception, __current_exception_context, __std_exception_copy, __std_exception_destroy, __std_terminate, __std_type_info_destroy_list …

Library: VCRUNTIME140_1.dll
Functions: __CxxFrameHandler4

Library: api-ms-win-crt-heap-l1-1-0.dll
Functions: _callnewh, calloc, free, malloc, realloc

Library: api-ms-win-crt-runtime-l1-1-0.dll
Functions: _beginthreadex, _cexit, _configure_narrow_argv, _crt_atexit, _endthreadex, _errno, _execute_onexit_table, _initialize_narrow_environment …

Library: api-ms-win-crt-string-l1-1-0.dll
Functions: __strncnt, _wcsdup, isalnum, isdigit, islower, isspace, isupper, iswalnum …

5 shown

Exports5+

5+ exported items

5+ exported items

View details · 5 shown

Name: ??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z

Name: ??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z

Name: ??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IEAAX_WAEBV_Locinfo@1@@Z

Name: ??0?$_Yarn@D@std@@QEAA@AEBV01@@Z

Name: ??0?$_Yarn@D@std@@QEAA@PEBD@Z

5 shown

Resources1

1 resources

1 resources
Resource types: RT_VERSION

View details · 1 shown

Type: RT_VERSION
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

5 issuers

Example subject: Microsoft Windows Software Compatibility Publisher
Issued by: Microsoft Windows Third Party Component CA 2013
Validity period (UTC): 2025-05-15 – 2026-05-15

View details · 5 shown

Subject: Microsoft Windows Software Compatibility Publisher
Issuer: Microsoft Windows Third Party Component CA 2013
Valid from: 1747333560.0
Valid to: 1778869560.0
Fingerprint: EC5F0D7EE2327688384B4FDF5D7633553A0D055F

Subject: Microsoft Windows Third Party Component CA 2013
Issuer: Microsoft Root Certificate Authority 2011
Valid from: 1367441040.0
Valid to: 1840827240.0
Fingerprint: 2F5540201B5799E6A3E2131C3D05753D23879FE0

Subject: Microsoft Root Certificate Authority 2011
Issuer: Microsoft Root Certificate Authority 2011
Valid from: 1300831500.0
Valid to: 2089836780.0
Fingerprint: 8F43288AD272F3103B6FB1428485EA3014C0BCFE

Subject: Microsoft Time-Stamp Service
Issuer: Microsoft Time-Stamp PCA 2010
Fingerprint: D5B07F69D6D267FA4AF008CBEA3A156F5EB6DEB4

Subject: Microsoft Time-Stamp PCA 2010
Issuer: Microsoft Root Certificate Authority 2010
Fingerprint: 36056A5662DCADECF82CC14C8B80EC5E0BCC59A6

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check