Suspicious
Unsigned binary with zero engine detections but direct-IP C2 heuristic fired; IPs are Microsoft Azure ranges, suggesting legitimate telemetry rather than malware.
7a17425bb9911f2b9c…e75908eb01The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This file presents a conflict between engine consensus and a single heuristic signal. Zero detections across 72 reporting engines (including 17 tier-1 vendors) is a strong benign indicator, especially for a file submitted 13 times over 1499 days. The direct-IP C2 heuristic fired because the sample contacted external IPs without DNS queries — a valid malware pattern in principle. However, the IPs (20.99.132.105, 23.216.147.64, 20.80.129.13, 131.253.33.203) are Microsoft Azure infrastructure, not typical attacker C2 servers. No sandbox malicious verdict, no dropped malicious children, no malicious host contacts, and no external researcher corroboration (CIRCL, MalwareBazaar, YARAify all negative) further support a benign classification. The unsigned status and lack of signer history are neutral given the file's age and prevalence.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 0/72 malicious (tier1Malicious=0, tier1FamilyConsensus.strong=false) — universal engine silence across tier-1, tier-2, and low-trust tiers
signing.verified=false, unsigned, no signer history — but file age 1499 days and medium prevalence (10 submitters) suggest established commodity software
triggeredHeuristics: MalwareTips.Synth.DirectIpC2 fired (medium severity) — contacted 4 IPs (20.99.132.105, 23.216.147.64, 20.80.129.13, 131.253.33.203) with zero domains
behaviour.offensiveCount=0, no MITRE techniques exclusive to malware; ambient techniques (T1027, T1071, T1082, T1574.002) are benign-common
behaviour.hasMaliciousSandboxVerdict=false, droppedChildren=null, contactedHosts=null, externalIntel all negative (CIRCL, MalwareBazaar, YARAify no hits)
- Zero detections across 76 antivirus engines (tier1Malicious=0)
- No tier-1 family consensus on any malware
- Contacted IPs are Microsoft Azure ranges (legitimate cloud infrastructure)
- No malicious sandbox verdict, no dropped malicious children, no malicious host contacts
- 1499-day file age with medium prevalence (13 submissions, 10 unique sources) suggests established software
- Direct-IP contact without DNS queries (heuristic flag: MalwareTips.Synth.DirectIpC2)
- Unsigned binary with no signer history
- Large file size (36 MB) with high-entropy code sections
- Ambient MITRE techniques present (T1027, T1071, T1082, T1574.002)
This file is likely benign or a false positive on the direct-IP heuristic. The universal engine silence and Microsoft Azure IP contact pattern are inconsistent with known malware. If you recognize the application, verify its source and publisher; if uncertain, monitor execution in an isolated environment before deployment.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 20.99.132.105
- 23.216.147.64
- 20.80.129.13
- 131.253.33.203
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C5C.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D08.tmp.csv
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D38.tmp.txt
- C:\Windows\System32\spp\store\2.0\cache\cache.dat
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER3053.tmp.WERInternalMetadata.xml
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 4 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence20.99.132.105 · 23.216.147.64 · 20.80.129.13
0 detections across 76 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- primal-light.exe
- Size
- 35.05 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 7a17425bb9911f2b9c580d6889e81eb2f9dce03042700cbb2a92e3e75908eb01
- MD5
- 9331aa21548c8ac89161f21ec17acb46
- SHA-1
- 5336f9346d295d2194af6d2dd126368bcf31e83f
- PE imphash
- 5e6bacfbb04af5bbb7584ee45b1b436b
- First seen (VT)
- 5/20/2022, 12:20:27 PM
- Last analysis (VT)
- 10/5/2025, 2:25:07 PM
- First scan (MalwareTips)
- 6/27/2026, 3:33:56 PM
- Last scan (MalwareTips)
- 6/27/2026, 3:33:56 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.