- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
faf7911561b43dfedd80278ceb254ce1e9bb89d52fb80af7dbf96ceac60ba24e- SHA1
7c288feb750a8b68262c1b1a8415076d1d9bf21f- MD5
b6871283e451ee1470c4c030df6d24a8- Filename
- faf79115_proformainv_112612.js.bin
- File type
- javascript
- MIME
- application/javascript
- File size
- 53543
- TLSH
T1AC33640F83A31258D6C424448D1AB09DB5F3B48E510FF1447A7AAAEFFE7DC461075AEA- SSDEEP
768:VNIy8WGadi9shPgKXOBgjw+ciqq3aS85uU6G7AMvajb81tbqVWQKEUZzML:cr6dlyBO2vuHoAMvajb81tbqVWzE2ML
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 38%.
Confidence signal
VirusSign reports 94% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections38%
VirusSign confidence94%
Relationship context18 visible
Threat classificationgen16
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
powershell
6072 bytes
drops
Filename
f7f9fd35_moduleanalysiscache.bin
File type
powershell
MIME
text/plain
Size
6072
SHA1
763975e01f3b3f809a87637962fcedb5595b6217
0%
16384 bytes
drops
Filename
1ca8647b_tmp6307.tmp.bin
MIME
application/octet-stream
Size
16384
SHA1
b42d7503774e1a1edad45dc653f21a13edcc2f6b
First seen
2015-09-26T17:39:45Z
0%
crt
1391 bytes
drops
Filename
96bcec06_6c(.bin
File type
crt
MIME
application/octet-stream
Size
1391
SHA1
cabd2a79a1076a31f21d253635cb039d4329a5e8
0%
sql
40960 bytes
drops
Filename
b281ce54_login data copy.bin
File type
sql
MIME
application/octet-stream
Size
40960
SHA1
953e7420801c76393902c0d6bb56148947e41571
0%
270336 bytes
drops
Filename
b1e963d7_zabhahqayqbfadea.bin
MIME
application/octet-stream
Size
270336
SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d
First seen
2013-10-14T05:45:38Z
Related IPs
Network IPs associated with this indicator.
5shown
11%
medium
CA
communicates
CIDR
96.44.154.0/23
Network
96.44.136.0-96.44.161.255
First seen
2026-03-10T15:16:33Z
Last seen
2026-11-13T14:30:33Z
25%
medium
US
communicates
CIDR
129.121.144.0/21
Network
129.121.0.0-129.121.255.255
First seen
2026-10-15T01:13:41Z
Last seen
2026-11-13T20:18:13Z
20%
medium
KR
communicates
CIDR
196.251.121.0/24
First seen
2026-08-21T09:43:33Z
Last seen
2026-11-13T14:30:33Z
30%
high
US
communicates
CIDR
64.224.17.0/24
Network
64.224.17.0-64.224.17.255
First seen
2023-11-10T19:57:40Z
Last seen
2026-11-13T20:18:14Z
0%
DE
communicates
CIDR
88.221.168.0/22
Network
88.221.168.0-88.221.175.255
First seen
2024-02-28T12:14:35Z
Last seen
2026-11-13T14:30:33Z
Related domains
Domains associated with this indicator.
4shown
20%
critical
.com
communicates
Root
websenorllc.com
TLD
com
First seen
2024-03-06T09:46:38Z
Last seen
2026-11-13T17:02:04Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
x1.i
First seen
2023-09-30T05:09:58Z
Last seen
2026-11-14T02:24:01Z
0%
.org
communicates
Root
lencr.org
TLD
org
Subdomain
i
First seen
2023-09-30T12:18:28Z
Last seen
2026-11-14T02:15:30Z
0%
.com
communicates
Root
windows.com
TLD
com
Subdomain
time
First seen
2023-09-30T04:07:43Z
Last seen
2026-11-14T02:33:52Z
Related URLs
URLs associated with this indicator.
4shown
20%
medium
communicates
HTTP status
200
Content length
3326538
Content SHA256
bc61ae431b9d2c7d181fbf2ebce91dd590e04859e311cc9e0d8b59e3fe18590f
First seen
2026-11-09T11:04:06Z
Last seen
2026-11-13T14:30:34Z
33%
medium
communicates
HTTP status
200
Content length
3326538
Content SHA256
bc61ae431b9d2c7d181fbf2ebce91dd590e04859e311cc9e0d8b59e3fe18590f
First seen
2026-10-29T14:56:56Z
Last seen
2026-11-13T20:18:16Z
32%
high
communicates
HTTP status
200
Content length
3326538
Content SHA256
bc61ae431b9d2c7d181fbf2ebce91dd590e04859e311cc9e0d8b59e3fe18590f
First seen
2026-10-08T23:24:39Z
Last seen
2026-11-13T20:18:15Z
0%
communicates
TLD
org
HTTP status
200
Content length
1391
Content SHA256
96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
First seen
2020-12-05T10:22:33Z
Analysis details
Severity: criticaltrojanjavascriptmalwarecve-2008-3021cve-2008-3018exploitdiscoveryexecution
Freshness: Fresh · Last seen today.
- Detection rate
- 38%
- Threat type
- trojan
- Family
- gen16
- Confidence
- 94%
- detection
- 38 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
faf7911561b43dfedd80278ceb254ce1e9bb89d52fb80af7dbf96ceac60ba24e- SHA1
7c288feb750a8b68262c1b1a8415076d1d9bf21f- MD5
b6871283e451ee1470c4c030df6d24a8- Filename
- faf79115_proformainv_112612.js.bin
- File type
- javascript
- MIME
- application/javascript
- File size
- 53543
- TLSH
T1AC33640F83A31258D6C424448D1AB09DB5F3B48E510FF1447A7AAAEFFE7DC461075AEA- SSDEEP
768:VNIy8WGadi9shPgKXOBgjw+ciqq3aS85uU6G7AMvajb81tbqVWQKEUZzML:cr6dlyBO2vuHoAMvajb81tbqVWzE2ML- First seen
- 2026-11-13T08:51:23Z
- Last seen
- 2026-11-13T14:30:31Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 18. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 38%.
Confidence signal
VirusSign reports 94% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family gen16.
Relationship context
18 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
19 timestamped observations are arranged from 2013-10-14 to 2026-11-13. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
4 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family gen16.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- faf79115_proformainv_112612.js.bin
- File type
- javascript
- MIME
- application/javascript
- Size
- 53543
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 80, 2404, 443
- 5+ outbound connections observed
- 4 domains, 5+ IPs, 4 URLs
- Common ports: 80, 2404, 443
- Protocols: HTTP, TCP
View details · 5 shown
- Domain
- 96.44.154.214
- URL
- http://96.44.154.214/1.jpg
- Protocol
- HTTP
- Domain
- 64.224.17.115
- URL
- http://64.224.17.115/img/1.jpg
- Protocol
- HTTP
- Domain
- 129.121.148.240
- URL
- http://129.121.148.240/img/pics/1.jpg
- Protocol
- HTTP
- IP
- 64.224.17.115
- Port
- 80
- Protocol
- TCP
- IP
- 196.251.121.250
- Port
- 2404
- Protocol
- TCP
5 shown
DNS request activity3
A3 response IPs
- 3 DNS requests observed
- 3 unique queries
- 3 response IPs
- Query types: A
- Response codes: NOERROR
View details · 3 shown
- Query
- websenorllc.com
- Type
- A
- Answers
- 103.21.58.60
- Response
- NOERROR
- Query
- x1.i.lencr.org
- Type
- A
- Answers
- 88.221.169.173
- Response
- NOERROR
- Query
- time.windows.com
- Type
- A
- Answers
- 51.137.137.111
- Response
- NOERROR
C2 candidates1
TCPports 2404
- 1 C2 candidate communications
- 0 domains, 1 IPs
- Common ports: 2404
- Protocols: TCP
View details · 1 shown
- IP
- 196.251.121.250
- Port
- 2404
- Protocol
- TCP