Report - dcc46d8207d7…9e5d2f3977

Malicious CriticalFILE

Quota 12

First seen: 2026-10-11T09:06:13Z
Last seen: 2026-11-10T16:31:29Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYminttrojan

RELATED INDICATORS17Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977
SHA1: d476f663b1701fed8fb20ba294b4459a4b593a87
MD5: b5cf4c5c5dc8ac0eaf450b3e942a1348
Filename: cookie_grabber.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1963520
Compile time: 2026-10-10T16:40:08Z
PE platform: x64 64-bit
PE sections: 7

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 38%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections38%

VirusSign confidence100%

Relationship context17 visible

Threat classificationmint

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

17 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

0e01c802cd33cec9b33182bcac6b04d5531abfe92c0b49cb207da077c35c44e7

0% csv 3638 bytes drops

Filename powershell.exe.log File type csv MIME text/plain Size 3638 SHA1 88fdd3467aec6f321a73fce21b35ce35b0b7b83f

3fbbd4c6d76130399b0c79cdf41758669224a91e05b7b216953f0c9728750865

0% json 4 bytes drops

Filename reflect-config.json File type json MIME application/json Size 4 SHA1 855ca7e4e0c1c862e50b76ecfb4184cc39df46fe

2ffc2e4f9808a00341a7b10364ce2beeffdc0bdffd4733d32c3a9248003d1c38

0% 20480 bytes drops

Filename 08314d49c0840402.dat MIME application/octet-stream Size 20480 SHA1 1902ea2eb5dbff860900a257a86c1e1e60b6f66b First seen 2022-12-14T00:02:13Z

fea8432f38872116520b504000cf3578e0c3bc72ddc763d47134425da4a5ef8b

0% 155648 bytes drops

Filename history MIME application/octet-stream Size 155648 SHA1 888915c4c2394ceff629880d8e811cf26a9b6a51 First seen 2022-12-31T22:23:50Z

0ec4f4c2eb5c6785c7a069b88b946af074f919230e09d8a2fe380ddf18432a7f

0% sql 129024 bytes drops

Filename tmp826b.tmp.dat File type sql MIME application/vnd.sqlite3 Size 129024 SHA1 c5870a89501f7f3ab75a04dce60bdba49124430f

Related IPs

Network IPs associated with this indicator.

5shown

150.171.110.195

0% US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2026-05-18T14:56:36Z Last seen 2026-11-11T05:42:37Z

172.67.205.107

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-09-29T02:20:22Z Last seen 2026-11-10T17:47:22Z

104.21.69.59

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-29T16:50:00Z Last seen 2026-11-10T17:47:22Z

150.171.74.13

0% US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2024-10-15T04:55:25Z Last seen 2026-11-11T05:50:09Z

150.171.73.13

0% US communicates

CIDR 150.171.64.0/18 Network 150.171.0.0-150.171.255.255 First seen 2024-10-13T08:23:50Z Last seen 2026-11-11T05:50:09Z

Related domains

Domains associated with this indicator.

5shown

dawdsdasdw.shop

11% medium .shop communicates

Root dawdsdasdw.shop TLD shop First seen 2026-10-06T02:58:08Z Last seen 2026-11-10T17:47:23Z

ip-api.com

5% low .com communicates

Root ip-api.com TLD com First seen 2023-09-30T15:26:15Z Last seen 2026-11-11T05:52:01Z

edge-consumer-static.azureedge.net

5% low .net communicates

Root azureedge.net TLD net Subdomain edge-consumer-static First seen 2023-10-29T04:39:06Z Last seen 2026-11-11T05:13:15Z

edge-mobile-static.azureedge.net

0% .net communicates

Root azureedge.net TLD net Subdomain edge-mobile-static First seen 2023-09-30T16:35:46Z Last seen 2026-11-11T05:51:30Z

business.bing.com

0% .com communicates

Root bing.com TLD com Subdomain business First seen 2023-09-28T23:47:31Z Last seen 2026-11-11T05:51:30Z

Related URLs

URLs associated with this indicator.

2shown

https://dawdsdasdw.shop/log

5% low communicates

TLD shop HTTP status 405 Content length 23 Content SHA256 12532477ed57684ac701cd69db198769976d62515bd9fe43ecd15d52dbb99025 First seen 2026-10-11T12:53:14Z

http://ip-api.com/json/

5% low communicates

TLD com HTTP status 200 Content length 293 Content SHA256 0fbf7512a030085b0e374a55a7a7a600ae2027dc32455349111fb9e95a5d1039 First seen 2014-02-12T22:16:52Z

Analysis details

Severity: criticaltrojan64bitexeenv-checkdebug-checkexec-delaystealerdiscoveryspywaredefense-evasionmacro-psobfuscated

Freshness: Fresh · Last seen today.

Detection rate: 38%
Threat type: trojan
Family: mint
Confidence: 100%
detection: 38 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: dcc46d8207d79029bf308c4a4cd99d2202e45d16ec7f95277e15ca9e5d2f3977
SHA1: d476f663b1701fed8fb20ba294b4459a4b593a87
MD5: b5cf4c5c5dc8ac0eaf450b3e942a1348
Filename: cookie_grabber.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1963520
Compile time: 2026-10-10T16:40:08Z
PE platform: x64 64-bit
PE sections: 7
Import libraries: 9
TLSH: T1AB958E17A26800EDD0B7C179C9075A07EBB2B4050731AAEB57D09B662F27EE15B7F720
SSDEEP: 24576:6MMmIxiB7jtDi272DZ9IGReClIsXx+aJWNsBj6mpYdAUiCggqtLxQQi:6MNzBc26nIGReClvhPOYydAN
Imphash: 3a1a73eb54b12058ed637911178cc06f
Richhash: b65573983919b2ed4606b6ea5c77e4f2
First seen: 2026-10-11T09:06:13Z
Last seen: 2026-11-10T16:31:29Z
Filename variants: 2 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 17. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 38%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family mint.

Relationship context

17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

18 timestamped observations are arranged from 2013-02-27 to 2026-10-11. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 38%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 17 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification mint

Classification context: type trojan, family mint.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: cookie_grabber.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 1963520
Compile time: 2026-10-10T16:40:08Z
PE platform: x64 64-bit
Entry point: 1285552
Sections: 7

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

env-checkdebug-checkexec-delaymacro-psobfuscated

View details · 5 shown

A DLL was loaded from a suspicious directory
A process created a hidden window
A scripting utility was executed
Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1564.003 — A process created a hidden window
Tactics: TA0005
T1059 · T1064 — A scripting utility was executed
Tactics: TA0002 · TA0005
T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Tactics: TA0004 · TA0005
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0028.001 — Bitcoin
Objectives: OB0003 · OB0005
Collection
Objectives: OB0003
E1059 — Command and Scripting Interpreter
Objectives: OB0009

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

TCP, HTTPports 443, 80

5+ outbound connections observed
2 domains, 5 IPs, 2 URLs
Common ports: 443, 80
Protocols: TCP, HTTP

View details · 5 shown

Domain: dawdsdasdw.shop
URL: https://dawdsdasdw.shop/log
Protocol: HTTP

Domain: ip-api.com
URL: http://ip-api.com/json/
Protocol: HTTP

IP: 208.95.112.1
Port: 80
Protocol: TCP

IP: 172.67.205.107
Port: 443
Protocol: TCP

IP: 150.171.73.13
Port: 443
Protocol: TCP

5 shown

DNS request activity5

A5+ response IPs

5 DNS requests observed
5 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: dawdsdasdw.shop
Type: A
Answers: 172.67.205.107, 104.21.69.59
Response: NOERROR

Query: ip-api.com
Type: A
Answers: 208.95.112.1
Response: NOERROR

Query: edge-consumer-static.azureedge.net
Type: A
Answers: 150.171.110.195
Response: NOERROR

Query: edge-mobile-static.azureedge.net
Type: A
Answers: 150.171.110.195
Response: NOERROR

Query: business.bing.com
Type: A
Answers: 150.171.73.13, 150.171.74.13
Response: NOERROR

C2 candidates2

DNS, HTTPports 53

2 C2 candidate communications
1 domains, 1 IPs
Common ports: 53
Protocols: DNS, HTTP

View details · 2 shown

IP: 172.67.205.107
Domain: dawdsdasdw.shop
Port: 53
Protocol: DNS

Domain: dawdsdasdw.shop
Protocol: HTTP

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-10-10T16:40:08Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 1285552
Sections: 7
Compile time: 2026-10-10T16:40:08Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 1539180
Raw size: 1539584
Permissions: rx
Entropy: 6.48

Name: .rdata
Virtual address: 1544192
Virtual size: 306080
Raw size: 306176
Permissions: r
Entropy: 6.03

Name: .data
Virtual address: 1851392
Virtual size: 27836
Raw size: 21504
Permissions: rw
Entropy: 2.59

Name: .pdata
Virtual address: 1880064
Virtual size: 68784
Raw size: 69120
Permissions: r
Entropy: 6.16

Name: .fptable
Virtual address: 1949696
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: ole32.dll
Functions: CLSIDFromString, CoCreateInstance, CoInitializeEx, CoSetProxyBlanket, CoTaskMemFree, IIDFromString

Library: OLEAUT32.dll
Functions: SysAllocStringByteLen, SysFreeString, SysStringByteLen

Library: SHELL32.dll
Functions: ShellExecuteW, SHGetFolderPathW, SHGetKnownFolderPath

Library: WINHTTP.dll
Functions: WinHttpAddRequestHeaders, WinHttpCloseHandle, WinHttpConnect, WinHttpOpen, WinHttpOpenRequest, WinHttpQueryDataAvailable, WinHttpQueryHeaders, WinHttpReadData …

Library: gdiplus.dll
Functions: GdipAlloc, GdipCloneImage, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipFree, GdipGetImageEncoders, GdipGetImageEncodersSize, GdiplusShutdown …

5 shown

Resources1

1 resources

1 resources
Resource types: RT_RCDATA

View details · 1 shown

Type: RT_RCDATA
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check