Report - e360a8e144f7…bdb7ea7b04

Malicious CriticalFILE

Quota 36

First seen: 2026-11-10T01:26:50Z
Last seen: 2026-11-10T15:49:40Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYcve170199trojan

RELATED INDICATORS22Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: e360a8e144f715974ef7b569b1c6ee8734abb773ef030d30e9eb2cbdb7ea7b04
SHA1: 03d619f19fe92230d16af274b47fd072ae2ae124
MD5: aa3dd35b9acd8ae6c06042e7f2eeca10
Filename: __substg1.0_37010102
File type: xls
MIME: application/octet-stream
File size: 979456
Filename variants: 4 reported
TLSH: T1AE252305FE80E807E6A652780ED6CFC6425CAD52094FCAC77351BB8E76F56B782DA00D
SSDEEP: 24576:pdiLHw8N+gtBa+td2qeOsW+gCW41WXNap2YVg:eLM/+tAasTlWkW9aYY

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 22. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 38%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections38%

VirusSign confidence100%

Relationship context22 visible

Threat classificationcve170199

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

22 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

2shown

c8dd5b717cc3291bf6cdf00889af563eebcebca778e77de4b4eb6d12401a7090

33% critical email 1348278 bytes drops

Filename mail20261110093725003.eml Family cve170199 Type exploit File type email MIME message/rfc822

85de1c1ecd5d6444b7b66681a1d19e041d07ab2413fc953f745df1d084599bc9

25% critical outlook 1014272 bytes drops

Filename RFQ261102 FDY-75.msg Family cve170199 Type exploit File type outlook MIME application/octet-stream

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

c1d83d15702c8306f431290e8b2aaafa9ff0c7e9e0b716554aee9bcb2d8a41a9

0% xlsx 631755 bytes contains

Filename Package File type xlsx MIME application/octet-stream Size 631755 SHA1 58e4144c5ec1fc0d8234b9a0fd2d5e5c064d4d2d

a5b7982914dd827a8b4656ac655adb415f7c4287dba3a45fd12d173bc5c5fcf8

0% lnk 1081 bytes drops

Filename RFQ261102 FDY-75.xls.LNK File type lnk MIME application/x-ms-shortcut Size 1081 SHA1 5b8e71086e7a72db646a97a21d872e0fe11bb5bf

90fad522cf3d763f46f11e29ef919143fd371aff5a6897367a951c7e8d534901

0% xml 193078 bytes drops

Filename A99CA62A-182E-49A6-8E47-827575BBBD16 File type xml MIME application/xml Size 193078 SHA1 35f897cda2e1d60e0e707346ed7d2f62f32f0473

be84b842025e4241bfe0c9f7b8f86a322e4396d893ef87ea1e29c74f47b6a22d

0% xml 118 bytes drops

Filename HeartbeatCache.xml.rtcrypted (copy) File type xml MIME application/xml Size 118 SHA1 8f9d967ac6ef34640f1f0845214fbc6994c0cb80

c88a0b907419a70c27ab7c1f8e5fb54441a4d9c3567e4c928fa7b2091194aecf

0% text 7 bytes drops

Filename campaign File type text MIME text/plain Size 7 SHA1 42a8f651d79fd005eeac0612df6442b983a01184

Related IPs

Network IPs associated with this indicator.

5shown

52.123.248.32

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-02T00:23:52Z Last seen 2026-11-10T15:50:21Z

52.123.248.60

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-29T11:08:21Z Last seen 2026-11-10T15:49:45Z

52.123.248.4

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-30T12:16:01Z Last seen 2026-11-10T15:49:45Z

52.123.248.82

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-29T07:34:11Z Last seen 2026-11-10T15:49:45Z

52.123.248.46

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-30T14:08:51Z Last seen 2026-11-10T15:49:45Z

Related domains

Domains associated with this indicator.

5shown

atm.teams.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.teams.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-10T15:50:22Z

atm.office.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.office.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-10T15:50:54Z

eip-terr-na.cdp1.digicert.com.akahost.net

0% .net communicates

Root akahost.net TLD net Subdomain eip-terr-na.cdp1.digicert.com First seen 2026-01-02T13:32:37Z Last seen 2026-11-10T16:02:10Z

svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain svc First seen 2023-11-09T10:19:11Z Last seen 2026-11-10T15:50:54Z

us2.roaming1.live.com.akadns.net

0% .net communicates

Root akadns.net TLD net Subdomain us2.roaming1.live.com First seen 2023-10-01T15:52:36Z Last seen 2026-11-10T15:50:55Z

Related URLs

URLs associated with this indicator.

5shown

http://107.173.143.60/dashboard/

5% low communicates

HTTP status 200 Content length 5126 Content SHA256 69ddb2d219499e34837b525f88f5c7b1998a22b66137011c2a10cb7887b26038 First seen 2026-11-10T01:40:51Z Last seen 2026-11-10T15:49:47Z

http://107.173.143.60/5fKN0/a.doc

5% low communicates

HTTP status 200 Content length 99406 Content SHA256 ee05da76ef0d54a85def1b5d4d1f1332a41c37de810e609586aece0dcaa4b2b8 First seen 2026-11-10T01:40:51Z Last seen 2026-11-10T15:49:47Z

http://107.173.143.60/82/swiss.js

5% low communicates

HTTP status 200 Content length 5036805 Content SHA256 c1fb33380ec3ff6a22d757c6caae9e84615d0594d835a2d4e918d6fdc079e0e5 First seen 2026-11-10T01:40:51Z Last seen 2026-11-10T15:49:47Z

http://107.173.143.60/

0% communicates

First seen 2026-11-09T11:35:41Z Last seen 2026-11-10T15:49:47Z

http://107.173.143.60/5fKN0/?…

5% low communicates

HTTP status 200 Content length 99406 Content SHA256 ee05da76ef0d54a85def1b5d4d1f1332a41c37de810e609586aece0dcaa4b2b8 First seen 2026-11-10T01:54:24Z Last seen 2026-11-10T15:49:47Z

Analysis details

Severity: criticaltrojanexploitcve-2017-11882wmi-activityattachmentobfuscatedcve-2019-0199cve-2017-0199xls

Freshness: Fresh · Last seen today.

Detection rate: 38%
Threat type: trojan
Family: cve170199
Confidence: 100%
detection: 38 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: e360a8e144f715974ef7b569b1c6ee8734abb773ef030d30e9eb2cbdb7ea7b04
SHA1: 03d619f19fe92230d16af274b47fd072ae2ae124
MD5: aa3dd35b9acd8ae6c06042e7f2eeca10
Filename: __substg1.0_37010102
File type: xls
MIME: application/octet-stream
File size: 979456
TLSH: T1AE252305FE80E807E6A652780ED6CFC6425CAD52094FCAC77351BB8E76F56B782DA00D
SSDEEP: 24576:pdiLHw8N+gtBa+td2qeOsW+gCW41WXNap2YVg:eLM/+tAasTlWkW9aYY
First seen: 2026-11-10T01:26:50Z
Last seen: 2026-11-10T15:49:40Z
Filename variants: 4 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 22. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 38%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family cve170199.

Relationship context

22 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

23 timestamped observations are arranged from 2010-02-01 to 2026-11-10. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 38%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 22 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification cve170199

Classification context: type trojan, family cve170199.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: __substg1.0_37010102
File type: xls
MIME: application/octet-stream
Size: 979456

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
A document file initiated network communications indicative of a potential exploit or payload download
A document or script file initiated network communications indicative of a potential exploit or payload download
A potential decoy document was displayed to the user
Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1071 · T1221 — A document file initiated network communications indicative of a potential exploit or payload download
Tactics: TA0005 · TA0011
T1071 — A potential decoy document was displayed to the user
Tactics: TA0011
T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Tactics: TA0004 · TA0005
T1055.011 — Allocates a big amount of memory (probably used for heap s)
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

B0030 — C2 Communication
Objectives: OB0004
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
Defense Evasion
Objectives: OB0006
B0033 — Denial of Service
Objectives: OB0008

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 443, 2133, 80

5+ outbound connections observed
3 domains, 5+ IPs, 5+ URLs
Common ports: 443, 2133, 80
Protocols: HTTP, TCP

View details · 5 shown

Domain: roaming.svc.cloud.microsoft
URL: https://roaming.svc.cloud.microsoft/rs/roamingsoapservice.svc
Protocol: HTTP

Domain: 107.173.143.60
URL: http://107.173.143.60/dashboard/
Protocol: HTTP

Domain: 107.173.143.60
URL: http://107.173.143.60/82/swiss.js
Protocol: HTTP

Domain: 107.173.143.60
URL: http://107.173.143.60/82/beautiful.hta
Protocol: HTTP

Domain: 107.173.143.60
URL: http://107.173.143.60/5fkn0/a.doc
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: roaming.svc.cloud.microsoft
Type: A
Answers: 52.110.1.64, 52.110.1.89, 52.110.1.53
Response: NOERROR

Query: roaming.svc.cloud.microsoft
Type: A
Answers: 52.110.2.70, 52.110.2.27, 52.110.2.25, 52.110.2.17
Response: NOERROR

Query: us2.roaming1.live.com.akadns.net

Query: uci.cdn.office.net
Type: A
Answers: 23.11.232.59, 23.11.232.120, 23.11.232.27, 23.11.232.100, 23.11.232.181, 23.11.232.119, 23.11.232.102, 23.11.232.103
Response: NOERROR

Query: prod.roaming1.live.com.akadns.net

5 shown

C2 candidates1

TCPports 2133

1 C2 candidate communications
0 domains, 1 IPs
Common ports: 2133
Protocols: TCP

View details · 1 shown

IP: 38.9.96.37
Port: 2133
Protocol: TCP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check