- First seen
- Last seen
THREAT SIGNALLow
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
f4cb60012c53d3ff282b18ad6b1406b7c4c2a659c82490d472025f818b72192f- SHA1
3ad25b0c9c5d2f8a9a0d83547e2ecbc28ad23600- MD5
9c38846f742e2b3e4955c5acd2ab4555- Filename
- VIDEO.DLL
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 493056
- Compile time
- 2022-12-08T07:35:36Z
- PE platform
- x64 64-bit
- PE sections
- 6
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Relationship context
13 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections4%
Relationship context13 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
4%
high
peexe
42941371 bytes
drops
Filename
IrfanView 4.65.exe
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
42941371
0%
peexe
36953948 bytes
drops
Filename
180d9e24896e59f22e5ccdf5af7455b9c40910db92c7ab654635494e59da8172.file
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Size
36953948
Compile time
2019-10-12T11:15:57Z
5%
high
zip
48765801 bytes
contains
Filename
IrfanView_Portable_4.62.zip
Type
trojan
File type
zip
MIME
application/zip
Size
48765801
5%
high
zip
48853847 bytes
drops
Filename
02ed6a79afe573df18793d8ad15efc1045c22d188d6fe862d8c815c9fdabfefb.file
Type
trojan
File type
zip
MIME
application/zip
Size
48853847
25%
high
peexe
41652700 bytes
drops
Filename
13c1b62be4af64ed1ca81bbc9f5a1bf1.virus
Family
schoolgirl
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
ico
20 bytes
contains
Filename
IDI_CHKPRODUCT
File type
ico
MIME
application/octet-stream
Size
20
SHA1
65f4cefce100e60fb5f37ee84f6c6079d8925964
0%
ico
20 bytes
contains
Filename
1
File type
ico
MIME
application/octet-stream
Size
20
SHA1
a022d5c1cfdd8aace0089f3e72f2eedd41bda464
0%
ico
20 bytes
contains
Filename
4
File type
ico
MIME
application/octet-stream
Size
20
SHA1
10327108dbfe50a33cc8452cf334f78078719bc3
0%
ico
20 bytes
contains
Filename
23031
File type
ico
MIME
application/octet-stream
Size
20
SHA1
de0c9059c97a1395fffb9e9c713c69b87a2f80f3
0%
ico
20 bytes
contains
Filename
513
File type
ico
MIME
application/octet-stream
Size
20
SHA1
e1e971338dd43d3942ca62ea65725a8b54a314f7
Related IPs
Network IPs associated with this indicator.
3shown
0%
US
communicates
CIDR
20.184.0.0/13
Network
20.180.0.0-20.191.255.255
First seen
2023-10-01T12:48:42Z
Last seen
2026-11-13T15:55:19Z
0%
US
communicates
CIDR
104.208.0.0/13
Network
104.208.0.0-104.215.255.255
First seen
2023-09-29T16:57:12Z
Last seen
2026-11-13T16:43:44Z
0%
US
communicates
CIDR
52.160.0.0/11
Network
52.145.0.0-52.191.255.255
First seen
2023-10-01T07:22:38Z
Last seen
2026-11-13T15:58:23Z
Analysis details
Severity: lowdebug-checkdll64bitexec-delaydotnet
Freshness: Fresh · Last seen 2 days ago.
- Detection rate
- 4%
- detection
- 4 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
f4cb60012c53d3ff282b18ad6b1406b7c4c2a659c82490d472025f818b72192f- SHA1
3ad25b0c9c5d2f8a9a0d83547e2ecbc28ad23600- MD5
9c38846f742e2b3e4955c5acd2ab4555- Filename
- VIDEO.DLL
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 493056
- Compile time
- 2022-12-08T07:35:36Z
- PE platform
- x64 64-bit
- PE sections
- 6
- Import libraries
- 3
- TLSH
T149A4D506B5906CA7E3D14534CCB6EA31E3253C2E87F382B73684B6D93E32AD07A35655- SSDEEP
6144:V+iixyZM2RNBgR36dqxY9nnSTWJIpsoyDLSfrwDnhgVgdaPydaKxqmu:5iy9dgRqdTnnWtz- Imphash
af22b5bbe9ec23f2d8bdfa59b6c89e8d- Richhash
cf30bc75662c894949572c7cae97b221- First seen
- 2022-12-09T13:28:11Z
- Last seen
- 2026-11-11T11:19:57Z
- Filename variants
- 5 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (4%).
Relationship context
13 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
14 timestamped observations are arranged from 1992-06-19 to 2023-10-01. These are observation or metadata times, not execution order.
Infrastructure geography
3 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Last seen 2 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- VIDEO.DLL
- File type
- pedll
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 493056
- Compile time
- 2022-12-08T07:35:36Z
- PE platform
- x64 64-bit
- Entry point
- 110776
- Sections
- 6
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- allocate thread local storage
- create directory
- delete file
- encode data using XOR
- encrypt data using RC4 PRGA
5 shown
View MITRE ATT&CK details · 5 shown
- T1497 · T1518.001 — Checks if the current process is being debuggedTactics: TA0005 · TA0007
- T1055 — Creates a process in suspended mode (likely to inject code)Tactics: TA0004 · TA0005
- T1497 — May sleep (evasive loops) to hinder dynamic analysisTactics: TA0005 · TA0007
- T1082 — Queries the volume information (name, serial number etc) of a deviceTactics: TA0007
- T1018 — Reads the hosts fileTactics: TA0007
5 shown
View MBC details · 5 shown
- C0040 — Allocate Thread Local StorageObjectives: OC0003
- E1510 — Clipboard ModificationObjectives: OB0008
- C0046 — Create DirectoryObjectives: OC0001
- C0016 — Create FileObjectives: OC0001
- B0003.003 — Delayed ExecutionObjectives: OB0001
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity3
TCPports 443
- 3 outbound connections observed
- 0 domains, 3 IPs, 0 URLs
- Common ports: 443
- Protocols: TCP
View details · 3 shown
- IP
- 52.182.143.212
- Port
- 443
- Protocol
- TCP
- IP
- 20.189.173.22
- Port
- 443
- Protocol
- TCP
- IP
- 104.208.16.94
- Port
- 443
- Protocol
- TCP
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
- Compile time: 2022-12-08T07:35:36Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 110776
- Sections
- 6
- Compile time
- 2022-12-08T07:35:36Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: r, rw, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 252172
- Raw size
- 252416
- Permissions
- rx
- Entropy
- 6.54
- Name
- .rdata
- Virtual address
- 258048
- Virtual size
- 194018
- Raw size
- 194048
- Permissions
- r
- Entropy
- 3.7
- Name
- .data
- Virtual address
- 454656
- Virtual size
- 17712
- Raw size
- 7168
- Permissions
- rw
- Entropy
- 3.1
- Name
- .pdata
- Virtual address
- 475136
- Virtual size
- 10044
- Raw size
- 10240
- Permissions
- r
- Entropy
- 5.57
- Name
- .rsrc
- Virtual address
- 487424
- Virtual size
- 25680
- Raw size
- 26112
- Permissions
- r
- Entropy
- 1.52
5 shown
Imports3
3 DLL groups
- 3 import DLL groups
- 5+ imported functions summarized
View details · 3 shown
- Library
- KERNEL32.dll
- Functions
- CloseHandle, CreateDirectoryW, CreateFileW, DecodePointer, DeleteCriticalSection, DeleteFileW, EncodePointer, EnterCriticalSection …
- Library
- USER32.dll
- Functions
- BeginPaint, BringWindowToTop, ClientToScreen, CloseClipboard, CreateDialogParamW, CreateWindowExW, DefWindowProcW, DestroyIcon …
- Library
- GDI32.dll
- Functions
- CreateDCW, DeleteDC, DeleteObject, GetDeviceCaps, GetDIBits, GetObjectW, GetStockObject, RealizePalette …
Exports5+
5+ exported items
- 5+ exported items
View details · 5 shown
- Name
- EndVideoShow
- Name
- ExtractVideoFrames_W
- Name
- GetFirstVideoFrame_W
- Name
- GetMovieInfoEx_W
- Name
- GetPlugInInfo
5 shown
Resources5+
5+ resources
- 5+ resources
- Resource types: RT_ICON, RT_GROUP_ICON, RT_DIALOG, RT_MENU, RT_VERSION
View details · 5 shown
- Type
- RT_ICON
- Language
- GERMAN AUSTRIAN
- Type
- RT_MENU
- Language
- GERMAN AUSTRIAN
- Type
- RT_DIALOG
- Language
- GERMAN AUSTRIAN
- Type
- RT_GROUP_ICON
- Language
- GERMAN AUSTRIAN
- Type
- RT_VERSION
- Language
- ENGLISH US