- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
e7a563fa5ee782697ee012e79332e990d2b33c919ba35684f6bf2e36ec6d0046- SHA1
224a173d29ba746c4961b3d1806263156362ffae- MD5
c5540e230fa0607679b3a7fa1e6930b4- Filename
- balmerlawrie.com_SKM_C590368369060_417161.pdf
- File type
- MIME
- application/octet-stream
- File size
- 77363
- TLSH
T1C273F258E91168DDE80E171536393B2C63BEB3313AC828C4CD7D9A228944DF6D917DC7- SSDEEP
1536:woLugz/RGZYsBsG9hl9qcUJ6ElEJJzwopynK8i4Uz:VLug7RGZZB19jE36/Bs7i44
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections9%
VirusSign confidence76%
Relationship context16 visible
Threat classificationphishingx
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
json
287 bytes
drops
Filename
DC_Reader_RHP_Retention
File type
json
MIME
application/json
Size
287
SHA1
b931a5b4d90ade449b2cfce55722c9d3fe53f82c
0%
bmp
71190 bytes
drops
Filename
icon-240630232919Z-243.bmp
File type
bmp
MIME
application/octet-stream
Size
71190
SHA1
e329fd73f9377265759cea9d90d4ed56b1c5b301
0%
json
767 bytes
drops
Filename
SOPHIA.json
File type
json
MIME
application/json
Size
767
SHA1
c74fdde5fa367b795e659a415b29a71940dc34d0
0%
json
285 bytes
drops
Filename
DC_READER_LAUNCH_CARD
File type
json
MIME
application/json
Size
285
SHA1
a5b68e2d172ab74cf0c2af14d1404c058a2e545f
0%
json
1395 bytes
drops
Filename
DC_Reader_RHP_Banner
File type
json
MIME
application/json
Size
1395
SHA1
c1c8a542686f3ff86c2a6e384cc9e103cc3e4f79
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
172.67.128.0/17
Network
172.64.0.0-172.71.255.255
First seen
2023-09-30T10:57:28Z
Last seen
2026-10-27T10:52:23Z
0%
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2023-10-03T06:38:14Z
Last seen
2026-10-27T10:52:22Z
0%
US
communicates
CIDR
18.239.94.0/23
Network
18.238.0.0-18.239.255.255
First seen
2023-10-01T00:02:04Z
Last seen
2026-11-02T22:43:03Z
KR
communicates
CIDR
3.36.0.0/14
First seen
2024-06-26T16:41:54Z
Last seen
2026-01-29T13:05:48Z
0%
DE
communicates
CIDR
2.23.192.0/20
Network
2.23.192.0-2.23.207.255
First seen
2025-11-02T09:46:51Z
Last seen
2025-11-26T04:46:37Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
balmerlawrie.com
TLD
com
First seen
2025-12-11T12:21:07Z
Last seen
2026-07-11T21:39:49Z
14%
high
.ru
communicates
Root
com.ru
TLD
ru
Subdomain
glanmire
First seen
2025-06-26T11:08:18Z
Last seen
2026-01-29T13:05:48Z
0%
.com
communicates
Root
bing.com
TLD
com
Subdomain
r.g
First seen
2019-01-06T02:35:03Z
Last seen
2026-10-01T10:54:18Z
0%
.com
communicates
Root
cloudflare.com
TLD
com
Subdomain
challenges
First seen
2023-09-29T13:38:17Z
Last seen
2026-11-13T00:35:04Z
0%
.com
communicates
Root
cloudflare.com
TLD
com
Subdomain
a.nel
First seen
2023-09-29T06:06:10Z
Last seen
2026-11-13T01:03:08Z
Related URLs
URLs associated with this indicator.
1shown
0%
communicates
TLD
org
HTTP status
200
Content length
1391
Content SHA256
96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
First seen
2020-12-05T10:22:33Z
Analysis details
Severity: highphishingpdfinput-checkadapter-discovery
Freshness: Historical · Last seen 862 days ago.
- Detection rate
- 9%
- Threat type
- phishing
- Family
- phishingx
- Confidence
- 76%
- detection
- 9 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
e7a563fa5ee782697ee012e79332e990d2b33c919ba35684f6bf2e36ec6d0046- SHA1
224a173d29ba746c4961b3d1806263156362ffae- MD5
c5540e230fa0607679b3a7fa1e6930b4- Filename
- balmerlawrie.com_SKM_C590368369060_417161.pdf
- File type
- MIME
- application/octet-stream
- File size
- 77363
- TLSH
T1C273F258E91168DDE80E171536393B2C63BEB3313AC828C4CD7D9A228944DF6D917DC7- SSDEEP
1536:woLugz/RGZYsBsG9hl9qcUJ6ElEJJzwopynK8i4Uz:VLug7RGZZB19jE36/Bs7i44- First seen
- 2024-06-26T01:47:01Z
- Last seen
- 2024-07-03T16:34:54Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 76%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type phishing and family phishingx.
Relationship context
16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
17 timestamped observations are arranged from 2019-01-06 to 2025-12-11. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type phishing, family phishingx.
Last seen 862 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- balmerlawrie.com_SKM_C590368369060_417161.pdf
- File type
- MIME
- application/octet-stream
- Size
- 77363
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A file was accessed within the Public folder.
- A file with an unusual extension was attempted to be loaded as a DLL.
- A possible heap spray exploit has been detected
- A process created a hidden window
- Accessed credential storage registry keys
5 shown
View MITRE ATT&CK details · 5 shown
- T1555.003 — Adversaries may acquire credentials from web browsers by reading files specific to the target browser.Tactics: TA0006
- T1003 — Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.Tactics: TA0006
- T1057 — Adversaries may attempt to get information about running processes on a system.Tactics: TA0007
- T1564 — Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.Tactics: TA0005
- T1036 — Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.Tactics: TA0005
5 shown
View MBC details · 5 shown
- Anti-Behavioral AnalysisObjectives: OB0001
- CommunicationObjectives: OC0006
- Credential AccessObjectives: OB0005
- E1485 — Data DestructionObjectives: OB0008
- Defense EvasionObjectives: OB0006
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 443, 53, 80
- 5+ outbound connections observed
- 1 domains, 5+ IPs, 1 URLs
- Common ports: 443, 53, 80
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- IP
- 188.114.96.0
- Port
- 443
- Protocol
- TCP
- IP
- 188.114.96.0
- IP
- 8.8.8.8
- Port
- 53
- Protocol
- UDP
- IP
- 239.255.255.250
- Domain
- x1.i.lencr.org
- URL
- http://x1.i.lencr.org/
- Protocol
- HTTP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- glanmire.com.ru
- Type
- A
- Answers
- 172.67.161.127, 104.21.66.155
- Response
- NOERROR
- Query
- x1.i.lencr.org
- Type
- A
- Answers
- 2.23.197.184
- Response
- NOERROR
- Query
- r.g.bing.com
- Type
- A
- Answers
- 13.74.129.92
- Response
- NOERROR
- Query
- edgedl.me.gvt1.com
- Type
- A
- Answers
- 34.104.35.123
- Response
- NOERROR
- Query
- challenges.cloudflare.com
- Type
- A
- Answers
- 104.17.3.184, 104.17.2.184
- Response
- NOERROR
5 shown