Report - 1d37c6e22c8d…92b6c52ff1

Malicious HighFILE

Quota 36

First seen: 2014-12-13T23:26:50Z
Last seen: 2026-10-01T11:08:50Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYwebbrowserpassviewtrojan

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousAging

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 1d37c6e22c8d0a8e5d815505a5f10ff21396ce6f5bd33787d58f3792b6c52ff1
SHA1: 4fc06eb8c3ef8dbbb87c1461e6b83aef6e7550f5
MD5: 16046d5a2adcb6715b6c7715a10da065
Filename: 3477.tmp.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 352864
Compile time: 2014-12-11T17:43:22Z
PE platform: x86 32-bit
PE sections: 4

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 65%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections65%

VirusSign confidence100%

Relationship context16 visible

Threat classificationwebbrowserpassview

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

722f7288749153b8f00f324570d75ed7b9ee288e80fa085544080e6f5d6b80d2

73% high zip 21453157 bytes contains

Filename NirLauncher Utilities Package v1.19.19.zip Family pswtool Type hacktool File type zip MIME application/zip

cae005f5a2765608788f57c18429dc1c975348917b4fd9a4e1a3467ca74bc5c7

83% critical peexe 4297216 bytes contains

Filename WebBrowserPassView.exe Family detrahere Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

bc7f8115eee5ee50801737e021246e6b6c341095c676b9c6b5f3bd9eea097473

67% critical peexe 413184 bytes contains

Filename Result.exe Family usteal Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

10bfaf4af31faeac706eda4db5c90e29799a49611ba9553fe6b6dd825bfe930e

83% critical peexe 4942336 bytes contains

Filename 5969296 Family darkkomet Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

7b0f95b97b1daa0ba68101f20c28e67868a6b744c49a1683fe036f6a2bfa0eae

83% critical peexe 4319744 bytes contains

Filename WebBrowserPassView.exe Family detrahere Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

fd28dc013993b51740e483720afd6fcc15d774cb063739e13857256ab81507a1

0% ico 1150 bytes contains

Filename 57.ico File type ico MIME application/octet-stream Size 1150 SHA1 1f5e9cb331e5875632b6e6c35d3b6e362e137ee1

477ecb39091b5183288f1f73e8e65d96d0a08616350affbc553f842e3d3ae330

0% ico 1150 bytes contains

Filename 83.ico File type ico MIME application/octet-stream Size 1150 SHA1 fba1f02ba8b34cf814b972526175c512010afb08

83053b5cd2e521212f67cd12da3386861ba5ac661a3df7e60a3a5a562dc2f2a3

0% ico 1150 bytes contains

Filename 7.ico File type ico MIME application/octet-stream Size 1150 SHA1 a552dcf4e7345d0ebe64f9a5d88344f06c30dea1

769e511973719904dff6bbe5bc87a0ee1b87eb5951229c3cd460b6f966db843f

0% 162 bytes contains

Filename routerpassview_105_5.bin MIME application/octet-stream Size 162 SHA1 18b2025138eabddd309ddf2ba7fcb4a5ec07a84b First seen 2014-07-19T11:06:12Z

7dfeeec2b8f6f65c3da239a2db4c65d1f1b4689eae459c13e9448da77432e8a7

0% 72 bytes contains

Filename 103 MIME application/octet-stream Size 72 SHA1 90b8f5f16f50d6d9497b1d3782581d620a76e2af First seen 2016-04-08T22:33:08Z

Related IPs

Network IPs associated with this indicator.

5shown

192.168.0.67

0% communicates

First seen 2022-11-23T01:58:06Z Last seen 2026-11-13T08:14:28Z

192.168.0.7

0% communicates

First seen 2022-12-09T07:40:29Z Last seen 2026-11-13T08:16:51Z

192.168.0.44

0% communicates

First seen 2022-12-15T06:28:11Z Last seen 2026-11-13T08:15:58Z

a83f:8110:7272:6f72:4c6f:674e:616d:6500

communicates

First seen 2025-08-23T20:53:15Z Last seen 2026-11-13T08:10:09Z

52.185.73.156

0% US communicates

CIDR 52.160.0.0/11 Network 52.145.0.0-52.191.255.255 First seen 2026-08-09T20:28:59Z Last seen 2026-11-13T05:37:27Z

Related domains

Domains associated with this indicator.

1shown

www.microsoft.com

0% .com communicates

Root microsoft.com TLD com Subdomain www First seen 2023-09-29T15:40:06Z Last seen 2026-11-13T08:20:37Z

Analysis details

Severity: hightrojandynamic-loadinginput-checkrevoked-certcpu-clockenv-checkfile-overlaydebug-checkexec-delayexeinvalid-signaturesigned

Freshness: Aging · Last seen 42 days ago.

Detection rate: 65%
Threat type: trojan
Family: webbrowserpassview
Confidence: 100%
detection: 65 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 1d37c6e22c8d0a8e5d815505a5f10ff21396ce6f5bd33787d58f3792b6c52ff1
SHA1: 4fc06eb8c3ef8dbbb87c1461e6b83aef6e7550f5
MD5: 16046d5a2adcb6715b6c7715a10da065
Filename: 3477.tmp.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 352864
Compile time: 2014-12-11T17:43:22Z
PE platform: x86 32-bit
PE sections: 4
Import libraries: 11
TLSH: T19D74AE53B3E28036E4FB0530166B4B32EEFD7A201635895757D41C49AEB02E1BA3E75B
SSDEEP: 6144:jKL9DOmGxcMttlliE/3rbzZWqwpi1HtnKIFE+5AtAAw5+ikih:u1tGxcMLlL73wpiaIFE+h+ik
Imphash: b299260c5dff726c8594676126be744a
Richhash: 9e2fe41305c4ae246943da3fa6a9f984
First seen: 2014-12-13T23:26:50Z
Last seen: 2026-10-01T11:08:50Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 65%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family webbrowserpassview.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 1992-06-19 to 2026-08-09. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 65%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification webbrowserpassview

Classification context: type trojan, family webbrowserpassview.

Intelligence freshness Aging

Last seen 42 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 3477.tmp.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 352864
Compile time: 2014-12-11T17:43:22Z
PE platform: x86 32-bit
Entry point: 272808
Sections: 4

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

env-checkinput-checkdebug-checkcpu-clockexec-delaydynamic-loading

View details · 5 shown

Binary contains paths to debug symbols
Classification label
Creates a DirectInput object (often for capturing keystrokes)
Disables application error messsages (SetErrorMode)
Enumerates running processes

5 shown

View MITRE ATT&CK details · 5 shown

T1555.003 — Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Tactics: TA0006
T1003 — Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.
Tactics: TA0006
T1057 — Adversaries may attempt to get information about running processes on a system.
Tactics: TA0007
T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Tactics: TA0011
T1552 — Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Tactics: TA0006

5 shown

View MBC details · 5 shown

E1010 — Application Window Discovery
Objectives: OB0007
B0032.020 — Argument Obfuscation
Objectives: OB0002
C0019 — Check String
Objectives: OC0004
E1510 — Clipboard Modification
Objectives: OB0008
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDPports 137, 443, 80

5+ outbound connections observed
0 domains, 5+ IPs, 0 URLs
Common ports: 137, 443, 80, 53
Protocols: TCP, UDP

View details · 5 shown

IP: a83f:8110:7272:6f72:4c6f:674e:616d:6500
Port: 53
Protocol: UDP

IP: 52.185.73.156
Port: 443
Protocol: TCP

IP: 23.55.140.42
Port: 80
Protocol: TCP

IP: 23.216.81.152
Port: 80
Protocol: TCP

IP: 20.99.133.109
Port: 443
Protocol: TCP

5 shown

DNS request activity2

A2 response IPs

2 DNS requests observed
1 unique queries
2 response IPs
Query types: A
Response codes: NOERROR

View details · 2 shown

Query: www.microsoft.com
Type: A
Answers: 23.216.81.152, 23.55.140.42
Response: NOERROR

Query: www.microsoft.com
Type: A
Answers: 23.55.140.42
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit4 sections

Platform: x86 32-bit
Sections: 4
Entry point: present
Compile time: 2014-12-11T17:43:22Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 272808
Sections: 4
Compile time: 2014-12-11T17:43:22Z

PE sections4

4 sections

4 PE sections
Common permissions: r, rw, rx
4 unique section names

View details · 4 shown

Name: .text
Virtual address: 4096
Virtual size: 270669
Raw size: 270848
Permissions: rx
Entropy: 6.59

Name: .rdata
Virtual address: 278528
Virtual size: 46308
Raw size: 46592
Permissions: r
Entropy: 5.75

Name: .data
Virtual address: 327680
Virtual size: 11524
Raw size: 5632
Permissions: rw
Entropy: 2.9

Name: .rsrc
Virtual address: 339968
Virtual size: 22504
Raw size: 22528
Permissions: r
Entropy: 5.12

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: msvcrt.dll
Functions: ??2@YAPAXI@Z, ??3@YAXPAX@Z, __dllonexit, __p__commode, __p__fmode, __set_app_type, __setusermatherr, __wgetmainargs …

Library: COMCTL32.dll
Functions: CreateStatusWindowW, CreateToolbarEx, ImageList_AddMasked, ImageList_Create, ImageList_ReplaceIcon, ImageList_SetImageCount, Ord(17)

Library: VERSION.dll
Functions: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Library: WININET.dll
Functions: FindCloseUrlCache, FindFirstUrlCacheEntryW, FindNextUrlCacheEntryW

Library: KERNEL32.dll
Functions: AreFileApisANSI, CloseHandle, CompareFileTime, CopyFileW, CreateFileA, CreateFileMappingW, CreateFileW, CreateToolhelp32Snapshot …

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_GROUP_ICON, RT_ICON, RT_STRING, RT_DIALOG, RT_BITMAP

View details · 5 shown

Type: RT_CURSOR
Language: ENGLISH US

Type: RT_BITMAP
Language: HEBREW DEFAULT

Type: RT_BITMAP
Language: ENGLISH US

Type: RT_ICON
Language: HEBREW DEFAULT

Type: RT_MENU
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

3 issuers

Example subject: Nir Sofer
Issued by: COMODO Code Signing CA 2
Validity period (UTC): 2014-09-12 – 2019-09-12

View details · 5 shown

Subject: Nir Sofer
Issuer: COMODO Code Signing CA 2
Valid from: 1410480000.0
Valid to: 1568332740.0
Fingerprint: A80BAEDA573DF2712F23A41857E648475EAC9BA5

Subject: COMODO Code Signing CA 2
Issuer: UTN-USERFirst-Object
Valid from: 1314144000.0
Valid to: 1590835680.0
Fingerprint: B64771392538D1EB7A9281998791C14AFD0C5035

Subject: UTN-USERFirst-Object
Issuer: AddTrust External CA Root
Valid from: 1118131740.0
Valid to: 1590835680.0
Fingerprint: 8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA

Subject: Sectigo (AddTrust)
Issuer: AddTrust External CA Root
Valid from: 959683680.0
Valid to: 1590835680.0
Fingerprint: 02FAF3E291435468607857694DF5E45B68851868

Subject: COMODO Time Stamping Signer
Issuer: UTN-USERFirst-Object
Fingerprint: 3DBB6DB5085C6DD5A1CA7F9CF84ECB1A3910CAC8

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check