Report - b6fa6edb0e95…352b4f489e

Malicious CriticalFILE

Quota 32

First seen: 2015-02-20T19:34:09Z
Last seen: 2026-08-29T20:32:11Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYpswtoolpua

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousAging

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: b6fa6edb0e958a897623e837947ed04a1cb52bdb31f567c55b5f10352b4f489e
SHA1: 3ac5fef9980ef3f029d9ac8e2299ee164993a8bd
MD5: f5e10085f53b6c562228907512e25402
Filename: pass6.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 352864
Compile time: 2015-02-18T14:00:39Z
PE platform: x86 32-bit
PE sections: 4

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 60%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections60%

VirusSign confidence100%

Relationship context16 visible

Threat classificationpswtool

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Parent files

Files that may have delivered, loaded, or executed this indicator.

5shown

1e86cefe40e12e76a9e60bcdfa83bf21c0756f64c59ddcc637ec6d74bc029cf3

8% high peexe 7903360 bytes drops

Filename CPLDAPU.exe Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 7903360

6a64984940080c9dae6d4c2f828174e898bbae7dfa1840be4b141a51dea55efa

83% critical peexe 674304 bytes contains

Filename WebBrowserPassView.exe.exe Family darkkomet Type trojan File type peexe MIME application/vnd.microsoft.portable-executable

256832b1351b17dd45d969a540941453aa614eaba42afbedc3a8b6d6b31c27e2

64% critical peexe 690688 bytes drops

Family passview Type trojan File type peexe MIME application/vnd.microsoft.portable-executable Size 690688

3e5558b1cf0ecbb232ba5ff2eae8c0c6db5eb7429bdff3e150d869a7e302aba7

78% critical zip 5597114 bytes contains

Filename Rabbit-Hole Autoit RAT v1.0 Beta 2.zip Family autoit Type trojan File type zip MIME application/zip

40fcd17089f9865d80380b0407faac7458ef35f07bb51a7ac8cb3121b86ef3d0

44% critical zip 230735 bytes contains

Filename webbrowserpassview_1.58.zip Family passview Type riskware File type zip MIME application/zip

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

769e511973719904dff6bbe5bc87a0ee1b87eb5951229c3cd460b6f966db843f

0% 162 bytes contains

Filename routerpassview_105_5.bin MIME application/octet-stream Size 162 SHA1 18b2025138eabddd309ddf2ba7fcb4a5ec07a84b First seen 2014-07-19T11:06:12Z

7dfeeec2b8f6f65c3da239a2db4c65d1f1b4689eae459c13e9448da77432e8a7

0% 72 bytes contains

Filename 103 MIME application/octet-stream Size 72 SHA1 90b8f5f16f50d6d9497b1d3782581d620a76e2af First seen 2016-04-08T22:33:08Z

623c7f0bb2b2af3f1f383cf9e875a8649840d12e542948c5ae614df63fdd0002

0% bmp 230 bytes contains

Filename SORT_ARROW_UP.bmp File type bmp MIME application/octet-stream Size 230 SHA1 c338e9e5be3a716c6d07d73a7083e29c9fa18f55

b47ec18790b022ee5e1b699b32625e7de342f274da9579d169cf48a2e3839f14

0% 308 bytes contains

Filename 51 MIME application/octet-stream Size 308 SHA1 f8eeb9a8734f582383b7318dcafb5a51bc9bf839 First seen 2014-07-19T11:33:23Z

cb0784eaf9ba8fb014c1040b0ec48db20dba5e6552a5c30834ef333f6c932c9f

0% 500 bytes contains

Filename 104 MIME application/octet-stream Size 500 SHA1 66869f37501b263855ea881cb95913b8a10fb370 First seen 2016-04-04T01:40:53Z

Related IPs

Network IPs associated with this indicator.

5shown

192.168.0.36

0% communicates

First seen 2022-12-08T06:41:44Z Last seen 2026-11-13T08:18:29Z

184.25.191.235

0% US communicates

CIDR 184.25.188.0/22 Network 184.24.0.0-184.31.255.255 First seen 2023-11-11T16:37:44Z Last seen 2026-11-13T07:45:58Z

23.216.147.78

0% US communicates

CIDR 23.216.144.0/21 Network 23.192.0.0-23.223.255.255 First seen 2026-08-22T23:41:45Z Last seen 2026-11-13T08:18:24Z

23.216.147.76

0% US communicates

CIDR 23.216.144.0/21 Network 23.192.0.0-23.223.255.255 First seen 2023-09-30T05:49:19Z Last seen 2026-11-13T08:14:36Z

20.99.185.48

0% US communicates

CIDR 20.64.0.0/10 Network 20.33.0.0-20.128.255.255 First seen 2023-09-29T22:00:59Z Last seen 2026-11-13T07:45:58Z

Related domains

Domains associated with this indicator.

1shown

www.microsoft.com

0% .com communicates

Root microsoft.com TLD com Subdomain www First seen 2023-09-29T15:40:06Z Last seen 2026-11-13T08:20:37Z

Analysis details

Severity: criticalpuadynamic-loadingexec-delaycpu-clockenv-checkexefile-overlayinvalid-signaturerevoked-certstealerspywaresigned

Freshness: Aging · Last seen 75 days ago.

Detection rate: 60%
Threat type: pua
Family: pswtool
Confidence: 100%
detection: 60 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: b6fa6edb0e958a897623e837947ed04a1cb52bdb31f567c55b5f10352b4f489e
SHA1: 3ac5fef9980ef3f029d9ac8e2299ee164993a8bd
MD5: f5e10085f53b6c562228907512e25402
Filename: pass6.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 352864
Compile time: 2015-02-18T14:00:39Z
PE platform: x86 32-bit
PE sections: 4
Import libraries: 11
TLSH: T10374AE53B3E28036E4FB0530166B4B32EEFD7A201635895757D41C89AEB02D1BB3A75B
SSDEEP: 6144:e13C/QLgE8x8JHFIQqf/c0cWFTUDap01mSmH+AAtRkih:+7LgE8SJMfvNTUDklH+Zk
Imphash: 982e5d7f3e2cdcf032fe338a95603262
Richhash: 9e2fe41305c4ae246943da3fa6a9f984
First seen: 2015-02-20T19:34:09Z
Last seen: 2026-08-29T20:32:11Z
Filename variants: 5 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 60%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type pua and family pswtool.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2011-07-03 to 2026-08-22. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 60%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification pswtool

Classification context: type pua, family pswtool.

Intelligence freshness Aging

Last seen 75 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: pass6.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 352864
Compile time: 2015-02-18T14:00:39Z
PE platform: x86 32-bit
Entry point: 272820
Sections: 4

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

env-checkcpu-clockexec-delaydynamic-loading

View details · 5 shown

Enumerates running processes
Network activity detected but not expressed in monitor API logs
Performs some HTTP requests
Possible date expiration check, exits too soon after checking local time
Queries the keyboard layout

5 shown

View MITRE ATT&CK details · 5 shown

T1555.003 — Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Tactics: TA0006
T1003 — Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.
Tactics: TA0006
T1057 — Adversaries may attempt to get information about running processes on a system.
Tactics: TA0007
T1071 — Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.
Tactics: TA0011
T1552 — Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Tactics: TA0006

5 shown

View MBC details · 5 shown

E1010 — Application Window Discovery
Objectives: OB0007
B0032.020 — Argument Obfuscation
Objectives: OB0002
C0019 — Check String
Objectives: OC0004
E1510 — Clipboard Modification
Objectives: OB0008
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, UDPports 443, 80, 53

5+ outbound connections observed
0 domains, 5+ IPs, 0 URLs
Common ports: 443, 80, 53, 137
Protocols: TCP, UDP

View details · 5 shown

IP: a83f:8110:8502:0:100:0:100:0
Port: 53
Protocol: UDP

IP: a83f:8110:0:0:1400:1400:2800:3800
Port: 53
Protocol: UDP

IP: 23.216.81.152
Port: 80
Protocol: TCP

IP: 23.216.147.78
Port: 80
Protocol: TCP

IP: 23.216.147.76
Port: 443
Protocol: TCP

5 shown

DNS request activity1

A1 response IPs

1 DNS requests observed
1 unique queries
1 response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: www.microsoft.com
Type: A
Answers: 23.216.81.152
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit4 sections

Platform: x86 32-bit
Sections: 4
Entry point: present
Compile time: 2015-02-18T14:00:39Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 272820
Sections: 4
Compile time: 2015-02-18T14:00:39Z

PE sections4

4 sections

4 PE sections
Common permissions: r, rw, rx
4 unique section names

View details · 4 shown

Name: .text
Virtual address: 4096
Virtual size: 270669
Raw size: 270848
Permissions: rx
Entropy: 6.59

Name: .rdata
Virtual address: 278528
Virtual size: 46308
Raw size: 46592
Permissions: r
Entropy: 5.75

Name: .data
Virtual address: 327680
Virtual size: 11524
Raw size: 5632
Permissions: rw
Entropy: 2.9

Name: .rsrc
Virtual address: 339968
Virtual size: 22504
Raw size: 22528
Permissions: r
Entropy: 5.12

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: msvcrt.dll
Functions: ??2@YAPAXI@Z, ??3@YAXPAX@Z, __dllonexit, __p__commode, __p__fmode, __set_app_type, __setusermatherr, __wgetmainargs …

Library: COMCTL32.dll
Functions: CreateStatusWindowW, CreateToolbarEx, ImageList_AddMasked, ImageList_Create, ImageList_ReplaceIcon, ImageList_SetImageCount, Ord(17)

Library: VERSION.dll
Functions: GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Library: WININET.dll
Functions: FindCloseUrlCache, FindFirstUrlCacheEntryW, FindNextUrlCacheEntryW

Library: KERNEL32.dll
Functions: AreFileApisANSI, CloseHandle, CompareFileTime, CopyFileW, CreateFileA, CreateFileMappingW, CreateFileW, CreateToolhelp32Snapshot …

5 shown

Resources5+

5+ resources

5+ resources
Resource types: RT_GROUP_ICON, RT_ICON, RT_STRING, RT_DIALOG, RT_BITMAP

View details · 5 shown

Type: RT_CURSOR
Language: ENGLISH US

Type: RT_BITMAP
Language: HEBREW DEFAULT

Type: RT_BITMAP
Language: ENGLISH US

Type: RT_ICON
Language: HEBREW DEFAULT

Type: RT_MENU
Language: ENGLISH US

5 shown

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5

3 issuers

Example subject: Nir Sofer
Issued by: COMODO Code Signing CA 2
Validity period (UTC): 2014-09-12 – 2019-09-12

View details · 5 shown

Subject: Nir Sofer
Issuer: COMODO Code Signing CA 2
Valid from: 1410480000.0
Valid to: 1568332740.0
Fingerprint: A80BAEDA573DF2712F23A41857E648475EAC9BA5

Subject: COMODO Code Signing CA 2
Issuer: UTN-USERFirst-Object
Valid from: 1314144000.0
Valid to: 1590835680.0
Fingerprint: B64771392538D1EB7A9281998791C14AFD0C5035

Subject: Sectigo (UTN Object)
Issuer: UTN-USERFirst-Object
Valid from: 931545060.0
Valid to: 1562697600.0
Fingerprint: E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46

Subject: UTN-USERFirst-Object
Issuer: AddTrust External CA Root
Fingerprint: 8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA

Subject: COMODO Time Stamping Signer
Issuer: UTN-USERFirst-Object
Fingerprint: 3DBB6DB5085C6DD5A1CA7F9CF84ECB1A3910CAC8

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Parent files

Dropped / child files

Related IPs

Related domains

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check