Report - ff9acd5b767e…9c84c49409

Malicious CriticalFILE

Quota 40

First seen: 2021-11-24T13:49:25Z
Last seen: 2021-12-18T07:41:20Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYlokibottrojan

RELATED INDICATORS17Connections in this report

ANALYSISMaliciousHistorical

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: ff9acd5b767e9eba90e7008f76e324d68284c3351f7ef0426de1a49c84c49409
SHA1: c35854d05d9e9e924b69069d5781078ea924beaa
MD5: cd3642284f88754f35fc1b92920ca5c9
Filename: Tax payment invoice - Saturday, November 29, 2021,pdf.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 317372
Compile time: 2008-10-10T21:49:01Z
PE platform: x86 32-bit
PE sections: 5

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 74%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections74%

VirusSign confidence100%

Relationship context17 visible

Threat classificationlokibot

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

17 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

1shown

f9941f91f6073a039fd05d085587763dafb8610ba02024f0f16fb47db8c89cab

33% critical isoimage 378880 bytes contains

Family gamarue Type trojan File type isoimage MIME application/octet-stream Size 378880

Dropped / child files

Files dropped, bundled, or created by the queried file.

1shown

dd17921b943c7f8986671c3d769a08d2591a84608069be9b1744c83a48ea7d16

57% critical pedll 98304 bytes contains

Filename gispdskevm.dll Family lokibot Type trojan File type pedll MIME application/vnd.microsoft.portable-executable

Related IPs

Network IPs associated with this indicator.

5shown

172.67.161.127

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-30T10:57:28Z Last seen 2026-10-27T10:52:23Z

104.21.66.155

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-10-03T06:38:14Z Last seen 2026-10-27T10:52:22Z

172.67.150.120

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-03T01:00:00Z Last seen 2026-11-12T00:01:38Z

104.21.30.35

0% US communicates

CIDR 104.20.0.0/15 Network 104.16.0.0-104.31.255.255 First seen 2023-09-30T16:34:38Z Last seen 2026-11-12T00:01:37Z

104.16.15.194

0% US communicates

CIDR 104.16.0.0/14 Network 104.16.0.0-104.31.255.255 First seen 2023-09-29T16:53:42Z Last seen 2026-10-14T16:16:03Z

Related domains

Domains associated with this indicator.

5shown

www.2lovit.com

0% .com communicates

Root 2lovit.com TLD com Subdomain www First seen 2018-10-18T10:07:56Z Last seen 2026-01-04T18:05:22Z

8sscal.icu

5% low .icu communicates

Root 8sscal.icu TLD icu First seen 2021-11-10T14:23:17Z Last seen 2026-03-06T02:09:42Z

www.eedrvheyn.sbs

0% .sbs communicates

Root eedrvheyn.sbs TLD sbs Subdomain www First seen 2021-11-10T14:23:17Z Last seen 2026-05-15T01:57:08Z

eedrvheyn.sbs

5% medium .sbs communicates

Root eedrvheyn.sbs TLD sbs First seen 2021-11-10T14:23:17Z Last seen 2025-12-08T06:41:37Z

www.surprisessinside.com

0% .com communicates

Root surprisessinside.com TLD com Subdomain www First seen 2026-03-25T17:34:38Z Last seen 2026-06-06T16:59:51Z

Related URLs

URLs associated with this indicator.

5shown

http://www.eedrvheyn.sbs/c1h5/?…

4% low communicates

TLD sbs HTTP status 404 Content length 16 Content SHA256 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 First seen 2021-11-30T16:31:05Z

http://www.dark9a.com/c1h5/?…

4% medium communicates

TLD com HTTP status 200 Content length 22466 Content SHA256 1dcf6ace373f6e2b11650a14ea9e9391f96bf48448d9fc02b29a6d16f6c3b2f4 First seen 2021-11-30T16:31:05Z

http://www.8sscal.icu/c1h5/?…

4% low communicates

TLD icu HTTP status 403 Content length 548 Content SHA256 25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393 First seen 2021-12-01T08:24:54Z

http://www.gyqfnc.com/c1h5/?…

4% low communicates

TLD com HTTP status 200 Content length 69 Content SHA256 2c8e70bb4369eca8e121d8223d7eea3b4d61046c016cfc97efce50b0c9f74fba First seen 2021-11-30T16:31:05Z

http://www.dalmonello.com/c1h5/?…

4% medium communicates

TLD com HTTP status 404 Content length 203 Content SHA256 53061e23a1ab6f9936444a0913cbb85b09f4c57f222aedfbf6bf16ca7c6b014d First seen 2021-11-30T16:31:05Z

Analysis details

Severity: criticaltrojanexefile-overlaydynamic-loadingdebug-checknsiscpu-clockratformbookstealerspyware

Freshness: Historical · Last seen 1789 days ago.

Detection rate: 74%
Threat type: trojan
Family: lokibot
Confidence: 100%
detection: 74 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: ff9acd5b767e9eba90e7008f76e324d68284c3351f7ef0426de1a49c84c49409
SHA1: c35854d05d9e9e924b69069d5781078ea924beaa
MD5: cd3642284f88754f35fc1b92920ca5c9
Filename: Tax payment invoice - Saturday, November 29, 2021,pdf.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 317372
Compile time: 2008-10-10T21:49:01Z
PE platform: x86 32-bit
PE sections: 5
Import libraries: 8
TLSH: T1546412D2CAE45A93E91A23700873EE2EA77B6E7818F1564FC7593F763B371570109222
SSDEEP: 6144:LGiR9+ROrNG5h3oSAKZ8kkhQP/InPGHCDQ0rsjOV5r5GjlS:mROW3o7KH/oPGYQhjOVhV
Imphash: 7fa974366048f9c551ef45714595665e
Richhash: a2c90b513348000252fc232c089e8adc
First seen: 2021-11-24T13:49:25Z
Last seen: 2021-12-18T07:41:20Z
Filename variants: 2 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 74%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family lokibot.

Relationship context

17 related indicators are shown across 5 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

18 timestamped observations are arranged from 2008-10-10 to 2026-03-25. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 74%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 17 visible

5 relationship group(s) provide pivot and infrastructure context.

Threat classification lokibot

Classification context: type trojan, family lokibot.

Intelligence freshness Historical

Last seen 1789 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: Tax payment invoice - Saturday, November 29, 2021,pdf.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 317372
Compile time: 2008-10-10T21:49:01Z
PE platform: x86 32-bit
Entry point: 12515
Sections: 5

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkcpu-clockdynamic-loading

View MITRE ATT&CK details · 5 shown

T1071 — C2 URLs / IPs found in malware configuration
Tactics: TA0011
T1497 · T1518.001 — Checks if the current process is being debugged
Tactics: TA0005 · TA0007
T1055 — Creates a process in suspended mode (likely to inject code)
Tactics: TA0004 · TA0005
T1057 — Queries a list of all running processes
Tactics: TA0007
T1083 — Reads ini files
Tactics: TA0007

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP

5+ outbound connections observed
5+ domains, 0 IPs, 5+ URLs
Protocols: HTTP

View details · 5 shown

Domain: www.nigeldavies.net
URL: http://www.nigeldavies.net/c1h5/?vpixmz=nweqeumxrzj5luafzjzg4wapzgvyyxhsrzljnc6xcdilwo2qbnxnwqjtsfqkzbofluy=&8pfx=opd80vkx2b2hmh
Protocol: HTTP

Domain: www.dark9a.com
URL: http://www.dark9a.com/c1h5/?vpixmz=rasebrmeb0hpqa6yzjnckwhxjxep/t0ulrhbhwkpwcuoijl1jn91fz/a7jnzj5zr4my=&8pfx=opd80vkx2b2hmh
Protocol: HTTP

Domain: www.dalmonello.com
URL: http://www.dalmonello.com/c1h5/?vpixmz=lc0ak3lrnl63rdio1lwhuzsjqrxbdrafufzkseqx8gnor7cxtov1ykiskytx6kp8nrm=&8pfx=opd80vkx2b2hmh
Protocol: HTTP

Domain: www.bountylux.com
URL: http://www.bountylux.com/c1h5/?vpixmz=ioumw9ycdvjmwulmnm8rhmd2mim9gyvkma+qtzymqzmjlwsnqzvj0ypjyuaoewn9dji=&8pfx=opd80vkx2b2hmh
Protocol: HTTP

Domain: www.analytics-at-scale.com
URL: http://www.analytics-at-scale.com/c1h5/?vpixmz=ecqut3o/txp59ptnce1svvq7mdnc6pwta44qsbjsxihzk7i9yt6a2kkfs+zbbzvruog=&lnm0i=whgpjfvhz2kpcv
Protocol: HTTP

5 shown

DNS request activity5+

A, A/AAAA5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A, A/AAAA
Response codes: NOERROR

View details · 5 shown

Query: www.wqbz1.com
Type: A
Answers: 35.190.2.20
Response: NOERROR

Query: www.theb8szsk5vkv.com
Type: A
Answers: 34.102.136.180
Response: NOERROR

Query: www.surprisessinside.com
Type: A
Answers: 23.227.38.74
Response: NOERROR

Query: www.nigeldavies.net
Type: A/AAAA
Answers: 2606:4700:3032::6815:429b, 2606:4700:3032::ac43:a17f, 172.67.161.127, 104.21.66.155
Response: NOERROR

Query: www.msftconnecttest.com
Type: A
Answers: 13.107.4.52
Response: NOERROR

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5 sections

Platform: x86 32-bit
Sections: 5
Entry point: present
Compile time: 2008-10-10T21:49:01Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 12515
Sections: 5
Compile time: 2008-10-10T21:49:01Z

PE sections5

5 sections

5 PE sections
Common permissions: r, rw, rx
5 unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 23400
Raw size: 23552
Permissions: rx
Entropy: 6.49

Name: .rdata
Virtual address: 28672
Virtual size: 4764
Raw size: 5120
Permissions: r
Entropy: 5.05

Name: .data
Virtual address: 36864
Virtual size: 154712
Raw size: 1024
Permissions: rw
Entropy: 4.77

Name: .ndata
Virtual address: 192512
Virtual size: 32768
Raw size: 0
Permissions: rw
Entropy: 0.0

Name: .rsrc
Virtual address: 225280
Virtual size: 18496
Raw size: 18944
Permissions: r
Entropy: 3.3

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: VERSION.dll
Functions: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Library: GDI32.dll
Functions: GetDeviceCaps, SetBkMode, CreateBrushIndirect, CreateFontIndirectA, SelectObject, SetBkColor, DeleteObject, SetTextColor

Library: ADVAPI32.dll
Functions: RegDeleteKeyA, RegCloseKey, RegQueryValueExA, RegSetValueExA, RegEnumValueA, RegCreateKeyExA, RegOpenKeyExA, RegEnumKeyA …

Library: KERNEL32.dll
Functions: GetLastError, lstrlenA, GetFileAttributesA, GlobalFree, WaitForSingleObject, GetExitCodeProcess, CopyFileA, ExitProcess …

Library: SHELL32.dll
Functions: SHGetFileInfoA, SHGetSpecialFolderLocation, SHBrowseForFolderA, SHGetPathFromIDListA, ShellExecuteA, SHFileOperationA

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_DIALOG, RT_GROUP_ICON, RT_ICON, RT_MANIFEST

View details · 4 shown

Type: RT_ICON
Language: ENGLISH US

Type: RT_DIALOG
Language: ENGLISH US

Type: RT_GROUP_ICON
Language: ENGLISH US

Type: RT_MANIFEST
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check