Report - e8329eb33b87…113b180ff0

Malicious CriticalFILE

Quota 40

First seen: 2026-11-03T12:43:19Z
Last seen: 2026-11-06T03:12:57Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmsiltrojan

RELATED INDICATORS12Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: e8329eb33b87602a41bcc3bb9ce920fcc66a9e61cf9679b0097bad113b180ff0
SHA1: 9a1f5872a3db58ba5cc212eb2f56273fe8e57852
MD5: 8bc294a5b2457efb9d1774bdca32a89d
Filename: e8329eb3_bak74ru.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 831488
Compile time: 2026-11-02T04:58:56Z
PE platform: x86 32-bit
PE sections: 3

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 74%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections74%

VirusSign confidence100%

Relationship context12 visible

Threat classificationmsil

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

12 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

8fc6210ec168a3f85c1cf4edd54a31cba24f3c75f755f0df457fabca8ca7051d

24% critical rar 713009 bytes contains

Filename 8fc6210e_aaa.rar.bin Family msil Type trojan File type rar MIME application/vnd.rar

Dropped / child files

Files dropped, bundled, or created by the queried file.

2shown

492e0fc1bcd047bdb4e17833b4539c7f1ccf44b8da3608c135f97f45b4d5fdf4

0% text 1389 bytes drops

Filename 492e0fc1_executable.exe.log.bin File type text MIME text/plain Size 1389 SHA1 0aff12b5e9b44b36c47d637a4becc87fa911d0b8

539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a

0% xml 490 bytes contains

Filename 539dc26a_manifest_1-x0.xml.bin File type xml MIME application/xml Size 490 SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734

Related IPs

Network IPs associated with this indicator.

5shown

52.123.248.2

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-01T10:24:27Z Last seen 2026-11-15T10:16:19Z

52.123.248.32

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-02T00:23:52Z Last seen 2026-11-15T10:30:48Z

52.123.248.60

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-29T11:08:21Z Last seen 2026-11-15T10:30:49Z

52.123.248.14

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-09-30T21:23:04Z Last seen 2026-11-15T10:54:16Z

52.123.248.21

0% US communicates

CIDR 52.123.0.0/16 Network 52.120.0.0-52.123.255.255 First seen 2023-10-07T08:26:17Z Last seen 2026-11-15T10:17:18Z

Related domains

Domains associated with this indicator.

3shown

ftp.ritubohara.com

25% medium .com communicates

Root ritubohara.com TLD com Subdomain ftp First seen 2025-12-23T01:36:45Z Last seen 2026-11-12T19:17:00Z

atm.teams.mira.tm.svc.cloud.microsoft

0% .microsoft communicates

Root cloud.microsoft TLD microsoft Subdomain atm.teams.mira.tm.svc First seen 2024-08-26T16:41:58Z Last seen 2026-11-15T10:54:36Z

ip-api.com

5% low .com communicates

Root ip-api.com TLD com First seen 2023-09-30T15:26:15Z Last seen 2026-11-15T10:54:26Z

Related URLs

URLs associated with this indicator.

1shown

http://ip-api.com/line/?…

5% low communicates

TLD com HTTP status 200 Content length 5 Content SHA256 a17fcf0a2f50e2d495e4f90ce263410edc183add6c62699a2facbccf60410f74 First seen 2020-07-04T15:31:32Z

Analysis details

Severity: criticaltrojandotnetwmi-activityexec-delaypolymorphicmalwaredebug-checkadapter-discoveryobfuscatedenv-checkexe

Freshness: Recent · Last seen 9 days ago.

Detection rate: 74%
Threat type: trojan
Family: msil
Confidence: 100%
detection: 74 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: e8329eb33b87602a41bcc3bb9ce920fcc66a9e61cf9679b0097bad113b180ff0
SHA1: 9a1f5872a3db58ba5cc212eb2f56273fe8e57852
MD5: 8bc294a5b2457efb9d1774bdca32a89d
Filename: e8329eb3_bak74ru.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 831488
Compile time: 2026-11-02T04:58:56Z
PE platform: x86 32-bit
PE sections: 3
Import libraries: 1
TLSH: T12405E04433AEEF02D5B99BF40AB0E23543B56D9A9631E3470EE6BCEB3825B406D14753
SSDEEP: 12288:L6hH4jp/m0txLSTrSVfca0YqxNJuLcrjLQYrITkd/TWyMGfU8vB13RL4lpF9:WhY9zXSTrSVV0YqxTdhEyOsppRL6F9
Imphash: f34d5f2d4577ed6d9ceec516c1f5a744
First seen: 2026-11-03T12:43:19Z
Last seen: 2026-11-06T03:12:57Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 74%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family msil.

Relationship context

12 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

13 timestamped observations are arranged from 2015-08-13 to 2026-11-02. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 74%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 12 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification msil

Classification context: type trojan, family msil.

Intelligence freshness Recent

Last seen 9 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: e8329eb3_bak74ru.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 831488
Compile time: 2026-11-02T04:58:56Z
PE platform: x86 32-bit
Entry point: 837050
Sections: 3

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityenv-checkadapter-discoverydebug-checkexec-delayobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Allocates memory with a write watch (potentially for evading sandboxes)
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Attempted to blind ETW telemetry by writing into ntdll!EtwEventWrite from dynamically allocated (unbacked) memory — a technique used by Brute Ratel, Havoc C2, and similar offensive frameworks to suppress event-tracing visibility

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Tactics: TA0004 · TA0005
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005
T1057 — Attempted to enumerate running processes from dynamically allocated (unbacked) memory
Tactics: TA0007

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
Cryptography
Objectives: OC0005

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity3

HTTP, TCPports 80

3 outbound connections observed
1 domains, 1 IPs, 1 URLs
Common ports: 80
Protocols: HTTP, TCP

View details · 2 shown

Domain: ip-api.com
URL: http://ip-api.com/line/?fields=hosting
Protocol: HTTP

IP: 208.95.112.1
Port: 80
Protocol: TCP

DNS request activity2

A5+ response IPs

2 DNS requests observed
2 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 2 shown

Query: ip-api.com
Type: A
Answers: 208.95.112.1
Response: NOERROR

Query: atm.teams.mira.tm.svc.cloud.microsoft
Type: A
Answers: 52.123.248.14, 52.123.248.60, 52.123.248.32, 52.123.248.3, 52.123.248.11, 52.123.248.2, 52.123.248.21, 52.123.248.27
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit3 sections

Platform: x86 32-bit
Sections: 3
Entry point: present
Compile time: 2026-11-02T04:58:56Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 837050
Sections: 3
Compile time: 2026-11-02T04:58:56Z

PE sections3

3 sections

3 PE sections
Common permissions: r, rx
3 unique section names

View details · 3 shown

Name: .text
Virtual address: 8192
Virtual size: 828864
Raw size: 828928
Permissions: rx
Entropy: 7.63

Name: .rsrc
Virtual address: 843776
Virtual size: 1532
Raw size: 1536
Permissions: r
Entropy: 4.21

Name: .reloc
Virtual address: 851968
Virtual size: 12
Raw size: 512
Permissions: r
Entropy: 0.1

Imports1

1 DLL groups

1 import DLL groups
1 imported functions summarized

View details · 1 shown

Library: mscoree.dll
Functions: _CorExeMain

Resources2

2 resources

2 resources
Resource types: RT_MANIFEST, RT_VERSION

View details · 2 shown

Type: RT_VERSION
Language: NEUTRAL

Type: RT_MANIFEST
Language: NEUTRAL

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check