4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f_EdgeCookiesView

Resubmissions

05/12/2025, 10:50

251205-mxff2agn5v9

01/12/2025, 09:07

251201-k3dtaagw3c9

Sharing

Copy URL Twitter E-mail

General

Target
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f_EdgeCookiesView
Size 103KB
Sample251205-mxff2agn5v
SHA256 4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f
MD5 4d4c98eca32b14aeb074db34cd0881e4
SHA1 92f213d609bba05d41d6941652a88c44936663a4
SHA512 959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf
SSDEEP 1536:0trHkMA28pdrmrk8/l5ugPC6TtlM0muwjwK2DwNjwG2wg71Thz5:KHtf8Krk8twJ4tO0EjwK2DwNjE771Tl5
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
sample	Nirsoft

NirSoft EdgeCookiesView 1 IoCs

Password recovery tool for Microsoft Edge browser

resource	yara_rule
sample	EdgeCookiesView

Untrusted Codesign Signers 1 IoCs

Codesigned binary was signed by an untrusted entity.

resource
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f_EdgeCookiesView

File Explorer

4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f_EdgeCookiesView

.exe 103KB

4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f_EdgeCookiesView

IMPHASH 07113130229f12197454e4bc4b69bb1b
SHA256 4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f
MD5 4d4c98eca32b14aeb074db34cd0881e4
SHA1 92f213d609bba05d41d6941652a88c44936663a4
SHA512 959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf
SSDEEP 1536:0trHkMA28pdrmrk8/l5ugPC6TtlM0muwjwK2DwNjwG2wg71Thz5:KHtf8Krk8twJ4tO0EjwK2DwNjE771Tl5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
NirSoft EdgeCookiesView

Password recovery tool for Microsoft Edge browser
Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

e8:46:1f:14:8a:cd:53:8f:c1:fa:e7:63:fe:18:13:c0:46:ce:c4:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Aug 17, 2019

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2014 - Sep 12, 2019

Minor OS version

Major OS version

Entry point

61566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Projects\VS2005\EdgeCookiesView\Release\EdgeCookiesView.pdb

msvcrt

_adjust_fdiv __setusermatherr _initterm __wgetmainargs _wcmdln exit _cexit _XcptFilter _exit _c_exit _onexit __p__commode _wcslwr strlen qsort _itow malloc wcscmp free wcschr modf __p__fmode __set_app_type _controlfp _except_handler3 __dllonexit _memicmp memcmp wcstoul wcsrchr strchr strtoul _wcsnicmp _wcsicmp _stricmp ??3@YAXPAX@Z ??2@YAPAXI@Z memcpy wcslen _wtoi _purecall wcscpy memset wcscat _snwprintf wcsncat

comctl32

ImageList_ReplaceIcon ImageList_Create ord17 ImageList_Add ImageList_AddMasked ImageList_SetImageCount CreateStatusWindowW CreateToolbarEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

DuplicateHandle OpenProcess ReadProcessMemory GetCurrentProcessId ExitProcess SetErrorMode GetStdHandle GetPrivateProfileIntW WritePrivateProfileStringW EnumResourceNamesW GetPrivateProfileStringW Process32FirstW Process32NextW CreateToolhelp32Snapshot EnumResourceTypesW GetModuleHandleA GetStartupInfoW GetModuleHandleW CreateFileMappingW UnmapViewOfFile MapViewOfFile SystemTimeToFileTime FileTimeToSystemTime CompareFileTime GetProcAddress FreeLibrary LoadLibraryW GetTickCount DeleteFileW GetFileSize CloseHandle SetFilePointerEx GetLastError GetTimeFormatW GetFileAttributesW GetWindowsDirectoryW FileTimeToLocalFileTime FindResourceW WriteFile ReadFile LoadResource GetModuleFileNameW SystemTimeToTzSpecificLocalTime CreateFileW LockResource LocalFree MultiByteToWideChar LoadLibraryExW GlobalAlloc lstrlenW lstrcpyW GlobalUnlock WideCharToMultiByte GetTempPathW GetCurrentProcess GetDateFormatW GetTempFileNameW SizeofResource FindNextFileW GlobalLock FindFirstFileW FormatMessageW FindClose GetVersionExW

user32

MonitorFromWindow GetMonitorInfoW DrawTextExW TranslateMessage IsDialogMessageW GetMessageW DispatchMessageW PostQuitMessage TrackPopupMenu RegisterWindowMessageW GetKeyState ChildWindowFromPoint GetDC CreateDialogParamW LoadCursorW SetCursor GetSysColorBrush ShowWindow SetDlgItemTextW GetDlgItemTextW InvalidateRect GetSystemMetrics GetWindowRect GetWindowPlacement DeferWindowPos GetDlgItemInt SetDlgItemInt GetWindow CreateWindowExW BeginPaint SetWindowPlacement GetClientRect EndPaint DrawFrameControl SendDlgItemMessageW EndDialog SetWindowLongW SetWindowTextW GetDlgItem UpdateWindow SendMessageW RegisterClassW MessageBoxW PostMessageW SetMenu TranslateAcceleratorW SetWindowPos GetForegroundWindow LoadAcceleratorsW DefWindowProcW LoadIconW LoadImageW GetWindowLongW GetSysColor EndDeferWindowPos BeginDeferWindowPos SetFocus KillTimer SetTimer GetParent SetClipboardData CheckMenuRadioItem CloseClipboard EnableWindow GetCursorPos MapWindowPoints GetMenu GetSubMenu EmptyClipboard EnableMenuItem GetClassNameW MoveWindow OpenClipboard CheckMenuItem GetMenuStringW GetMenuItemCount EnumChildWindows LoadStringW GetDesktopWindow DestroyWindow GetWindowTextW LoadMenuW ModifyMenuW GetMenuItemInfoW GetDlgCtrlID DestroyMenu DialogBoxParamW ReleaseDC

gdi32

GetTextExtentPoint32W GetStockObject SetBkColor GetObjectW DeleteDC SetPixel GetPixel SelectObject CreateCompatibleDC SetTextColor CreateFontIndirectW GetDeviceCaps SetBkMode DeleteObject

comdlg32

ChooseFontW FindTextW GetSaveFileNameW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFileInfoW ShellExecuteW

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f_EdgeCookiesView

PE Signature issue

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

generic