Report - eb73dafd0aec…7074af7fe8

Malicious HighFILE

Quota 26

First seen: 2026-10-17T12:28:57Z
Last seen: 2026-10-24T20:36:16Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYdllhijacktrojan

RELATED INDICATORS7Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: eb73dafd0aec0897d967410455f52e374280f9624570fac9bb0dd27074af7fe8
SHA1: 05d8df8562038c51620f2dffda444df39d140faf
MD5: 3a8ed782a043443cf4415dcee22a40cb
Filename: 89wikejo.exe
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 899936
Compile time: 2026-10-16T07:34:30Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 54%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections54%

VirusSign confidence100%

Relationship context7 visible

Threat classificationdllhijack

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

7 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

2shown

9e1f54f7716b932e8d33818574d6b6b2a3806cf6dbb82e4128aee66d32cb3d61

60% high isoimage 4734976 bytes contains

Filename 817.img Family dllhijack Type trojan File type isoimage MIME application/octet-stream

fb6582173d18117475b06da1470abaace91b233bb6a14776566162760329d3ea

59% high zip 1828408 bytes contains

Filename DX04_11709.zip Family dllhijack Type trojan File type zip MIME application/zip

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

e42efd0f77978a88dc57dce5859f40dea2908d73bbe7ca7dcce036ead7020070

61% high peexe 66912 bytes drops

Filename erasecode.dat Family yogi Type adware File type peexe MIME application/vnd.microsoft.portable-executable

8aaa290109531a4af4334ec056a8e144fd251761a4684a2a35e61732748d8fa9

0% ico 9662 bytes contains

Filename VirusShare_4e986d9d7425b0c3799af8124a299b3e File type ico MIME application/octet-stream Size 9662 SHA1 0716722a88ca46961915a5cea4c06ce96ee0ed2d

9a6a6c6c6c850a64bf015d15b2ab5436aacf512bc5ae7d647b3a228ffc84c199

0% ico 4286 bytes contains

Filename VirusShare_a775e13908f9cf35b19aa988a506e47e File type ico MIME application/octet-stream Size 4286 SHA1 785f325c7f21f554c85a32a3f6e6bcbee2da97c7

078ea7e98303d3765240c0fefbf9d5d143888eb8082cdb31c8dbfcd9779f02cc

0% ico 67646 bytes contains

Filename VirusShare_5cb311859df6b212afd49f52322ef257 File type ico MIME application/octet-stream Size 67646 SHA1 6e0e0c7cbb488c4549d88c4a906ff4fb7cda5d73

101c30de620e4bed1b4befed96a4d3819e8b40b06a8e4cff699ea89e9813b9ed

0% ico 38078 bytes contains

Filename VirusShare_b2d5de18a0df52c852942199e50ebb83 File type ico MIME application/octet-stream Size 38078 SHA1 f1f4da85b5a6fe04325bedc444c117a7b1f0924e

Analysis details

Severity: hightrojanfile-overlaydll64bitobfuscatedsigned

Freshness: Recent · Last seen 17 days ago.

Detection rate: 54%
Threat type: trojan
Family: dllhijack
Confidence: 100%
detection: 54 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: eb73dafd0aec0897d967410455f52e374280f9624570fac9bb0dd27074af7fe8
SHA1: 05d8df8562038c51620f2dffda444df39d140faf
MD5: 3a8ed782a043443cf4415dcee22a40cb
Filename: 89wikejo.exe
File type: pedll
MIME: application/vnd.microsoft.portable-executable
File size: 899936
Compile time: 2026-10-16T07:34:30Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 6
TLSH: T11A157DFFAA580B69E0577130BC571481EBA17F370671E18E03E337611F2776B4A6A226
SSDEEP: 12288:qQDuVFL3xsRaPV/K7P5bzrh9O8nRf3LnuhNOb5P7+y:DQiaPoj5bzx7nuXry
Imphash: c09d5870c6b60da78c05489d931e295e
Richhash: 730a523fc2882144b0bdd1100b195e1d
First seen: 2026-10-17T12:28:57Z
Last seen: 2026-10-24T20:36:16Z
Filename variants: 3 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 7. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 54%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family dllhijack.

Relationship context

7 related indicators are shown across 2 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

8 timestamped observations are arranged from 2016-05-18 to 2026-10-18. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 54%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 7 visible

2 relationship group(s) provide pivot and infrastructure context.

Threat classification dllhijack

Classification context: type trojan, family dllhijack.

Intelligence freshness Recent

Last seen 17 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 89wikejo.exe
File type: pedll
MIME: application/vnd.microsoft.portable-executable
Size: 899936
Compile time: 2026-10-16T07:34:30Z
PE platform: x64 64-bit
Entry point: 210588
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

obfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
Authenticode signature is invalid
Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)
Binary contains paths to debug symbols
Binary file triggered YARA rule

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1036 · T1553.002 — Authenticode signature is invalid
Tactics: TA0005 · TA0112
T1071 — Binary file triggered YARA rule
Tactics: TA0011
T1548.002 — Disable UAC(promptonsecuredesktop)
Tactics: TA0004
T1547.008 — Enables driver privileges
Tactics: TA0003 · TA0004

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
C0026.001 — Base64
Objectives: OC0004
C0019 — Check String
Objectives: OC0004
E1059 — Command and Scripting Interpreter
Objectives: OB0009

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-10-16T07:34:30Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 210588
Sections: 7
Compile time: 2026-10-16T07:34:30Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 393184
Raw size: 393216
Permissions: rx
Entropy: 6.47

Name: .rdata
Virtual address: 397312
Virtual size: 123902
Raw size: 123904
Permissions: r
Entropy: 5.06

Name: .data
Virtual address: 524288
Virtual size: 17884
Raw size: 10240
Permissions: rw
Entropy: 3.66

Name: .pdata
Virtual address: 544768
Virtual size: 16896
Raw size: 16896
Permissions: r
Entropy: 5.73

Name: .fptable
Virtual address: 565248
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: KERNEL32.dll
Functions: AssignProcessToJobObject, CloseHandle, CompareStringEx, CompareStringW, CreateDirectoryW, CreateFileW, CreateJobObjectW, CreatePipe …

Library: USER32.dll
Functions: FindWindowW, SendMessageW, SetWindowPos, ShowWindow

Library: ADVAPI32.dll
Functions: AdjustTokenPrivileges, AllocateAndInitializeSid, CheckTokenMembership, CloseServiceHandle, CreateServiceW, FreeSid, GetTokenInformation, LookupPrivilegeValueW …

Library: SHELL32.dll
Functions: CommandLineToArgvW, SHGetFolderPathW

Library: ole32.dll
Functions: CoCreateInstance, CoGetObject, CoInitializeEx, CoUninitialize

5 shown

Exports5+

5+ exported items

5+ exported items

View details · 5 shown

Name: dr_call_test

Name: dr_data_base_ext

Name: dr_data_base_info

Name: dr_data_base_info2

Name: dr_data_changestate

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_ICON, RESDATA, RT_GROUP_ICON, RT_MANIFEST, RT_VERSION

View details · 5 shown

Type: RESDATA
Language: CHINESE TRADITIONAL

Type: RT_ICON
Language: CHINESE TRADITIONAL

Type: RT_GROUP_ICON
Language: CHINESE TRADITIONAL

Type: RT_VERSION
Language: CHINESE TRADITIONAL

Type: RT_MANIFEST
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates4

4 issuers

Example subject: SmartSphere Solutions Ltd.
Issued by: SmartSphere Solutions Ltd.
Validity period (UTC): 2002-12-31 – 2099-12-30

View details · 4 shown

Subject: SmartSphere Solutions Ltd.
Issuer: SmartSphere Solutions Ltd.
Valid from: 1041350400.0
Valid to: 4102329600.0
Fingerprint: CCF2506972B94EAA0851B3EE5F974FB1D2B62715

Subject: Sectigo Public Time Stamping Root R46
Issuer: USERTrust RSA Certification Authority
Fingerprint: 853D632D938282617CD09035C491DE92C142DAC7

Subject: Sectigo Public Time Stamping CA R41
Issuer: Sectigo Public Time Stamping Root R46
Fingerprint: 65C328696F7D4E502CFD03C7C2069718CAFBF74F

Subject: Sectigo Public Time Stamping Signer R37
Issuer: Sectigo Public Time Stamping CA R41
Fingerprint: E97818A928DA150A9FE1BF9CCC7AABB9A00EEEAC

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check