Unknown
Our AI analyst is temporarily unavailable, so we've applied a conservative fallback: all 72 antivirus engines that scanned this file report it as clean.
62c5a559f0ea7a5938…ddd2a7c8ccThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
Our AI analyst is temporarily unavailable, so we've applied a conservative fallback: all 72 antivirus engines that scanned this file report it as clean. With that much coverage, the file looks safe — but re-scan in a few minutes to get the full AI assessment.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
AI arbiter unavailable (reason: grok_http_403:{"code":"The caller does not have permission to execute the specified operation","error":"Your team 9dd48cd8-6db1-4c4c-88ed-8651d1e175c4 has either used all ava)
engines.tier1Malicious=0
engines.reporting=72
- 72 antivirus engines all report this file as clean.
The file appears safe based on antivirus coverage. Re-scan for the full AI assessment.
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 204.79.197.203
- 20.99.186.246
- 192.229.211.108
- 104.96.203.51
- 20.99.184.37
- 20.99.185.48
- 20.99.133.109
- 23.216.81.152
- 131.253.33.203
- 192.168.0.6
- C:\Documents and Settings\Administrator\Local Settings\Temp\gm_ttt_28564\D3DX8.dll
- C:\Users\<USER>\AppData\Local\Temp\gm_ttt_55444\D3DX8.dll
- C:\Users\<USER>\AppData\Local\Temp\gm_ttt_55444\a26369.mp3
- C:\Users\<USER>\AppData\Local\Temp\gm_ttt_55444\a1996.mp3
- C:\Users\user\AppData\Local\Temp\gm_ttt_85096
- C:\Windows\System32\spp\store\2.0\cache\cache.dat
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER602C.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER6107.tmp.csv
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER6136.tmp.txt
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER65BB.tmp.WERInternalMetadata.xml
- DDrawWindowListMutex
- __DDrawExclMode__
- __DDrawCheckExclMode__
- DDrawDriverObjectListMutex
- CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache.
- edfc5f86be36c2c509e4…2b076aNever scannednever seen before
- 8109b7c55610d9836514…7766bdNever scannednever seen before
- 7ecaa4e8095301c5357e…da239eNever scannednever seen before
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 13 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence204.79.197.203 · 20.99.186.246 · 192.229.211.108
0 detections across 76 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- jilloff.exe
- Size
- 13.96 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 62c5a559f0ea7a5938ccd0396c754cebcf5a1e9e9983a62ab5c94fddd2a7c8cc
- MD5
- 361ef67aa047cc20cfe16eeea2a6b25d
- SHA-1
- 7ef390ab6cb722025a76c18507ae914565ad4dc1
- PE imphash
- faaa682bc37e74582e30337c8af101cd
- First seen (VT)
- 12/26/2010, 11:46:41 AM
- Last analysis (VT)
- 12/2/2024, 6:09:11 PM
- First scan (MalwareTips)
- 5/28/2026, 3:56:00 AM
- Last scan (MalwareTips)
- 5/28/2026, 3:56:00 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.