Snaffler[.]exe | Triage

Sharing

General

Target

Snaffler.exe
Size

478KB
MD5

0bb4254ed7b3c281968516a0c87d5510
SHA1

ef328f68c6d865ba4ef4223b5d8ee9efb5667420
SHA256

71bb8b15b1fbab1ebe7cd7898397d8a8a627af06dc510437f25887aa0aa0e4e1
SHA512

b77a198a126300fe332772576000ef96a030c5144e85f7a8b6631c29fe0ae0d9c24e20a5fabd57e4022e8bb404db7528a685a9eafd6266a6e5da5571c78d896c
SSDEEP

12288:8gmBDtyTkMwWGKb4CGXioYjdXsTFqSd2cH2GrxTIbO:rmBikMSocb2sTFqO2cHZNMb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Snaffler.exe

Files

Snaffler.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 475KB - Virtual size: 475KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ