crypto-sniper-main[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

crypto-sniper-main.zip
Size

10.4MB
MD5

67b498ab61bffe6fdc062c9d6fd44fa5
SHA1

ce4d6c6624831242e40c2d318d7050ca5dec7fe6
SHA256

b6cd9ee79348c1b25ade9f494180124ee8b3c2de0da4eb277907807cc0405404
SHA512

2d5199c6f40df461afbc159fcfbbd8a8c248c3ada2c791a8f901c765811975443d14efd376aea8eef9e039a7816b69f21a164a8a6104e4124838deb30d2d65fd
SSDEEP

196608:lzudW5zkRA5mcAn4Osi5Dxa6hELl1NQIwQui+/UkMQ+LeaFapW2LU+pEAqC:kdMzUA5bpKDQ1NQsdHfzFapW2QnC

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/crypto-sniper-main/crypto-token-sniper.exe	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/crypto-sniper-main/crypto-token-sniper.exe

Files

crypto-sniper-main.zip
.zip
crypto-sniper-main/Abis/Erc20.json
crypto-sniper-main/Abis/Pair.json
crypto-sniper-main/Abis/PairCreated.json
crypto-sniper-main/Abis/Pancake.json
crypto-sniper-main/appsettings.json
crypto-sniper-main/clrcompression.dll
.dll windows:6 windows x64 arch:x64

5c60dda7f0e42c4ab1a4510cd287d92f

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:6f:df:5f:57:e7:36:0b:76:82:19:49:6f:18:41:b6:5e:c0:b9:85:15:26:5d:1c:a2:a4:d3:4f:f1:99:94:7e
Signer

Actual PE Digest

b8:6f:df:5f:57:e7:36:0b:76:82:19:49:6f:18:41:b6:5e:c0:b9:85:15:26:5d:1c:a2:a4:d3:4f:f1:99:94:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\workspace\_work\1\s\artifacts\obj\native\net5.0-Windows_NT-Release-x64\clrcompression\Release\clrcompression.pdb

Imports

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

api-ms-win-crt-math-l1-1-0

log2

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_seh_filter_dll
_initterm_e
terminate
_configure_narrow_argv
abort
_initterm
exit
_execute_onexit_table
_cexit

api-ms-win-crt-string-l1-1-0

wcsncmp

Exports

Exports

BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliSetDictionaryData
CompressionNative_Crc32
CompressionNative_Deflate
CompressionNative_DeflateEnd
CompressionNative_DeflateInit2_
CompressionNative_Inflate
CompressionNative_InflateEnd
CompressionNative_InflateInit2_

Sections

.text
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypto-sniper-main/clrjit.dll
.dll windows:6 windows x64 arch:x64

683f62770505579f5d043e11a2df1dd0

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:24:0f:e3:a8:93:59:21:3b:63:53:d8:dd:34:f1:d9:c8:99:fb:77:30:ca:fa:b9:1f:a5:f7:a7:98:cc:35:a0
Signer

Actual PE Digest

b3:24:0f:e3:a8:93:59:21:3b:63:53:d8:dd:34:f1:d9:c8:99:fb:77:30:ca:fa:b9:1f:a5:f7:a7:98:cc:35:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\workspace\_work\1\s\artifacts\obj\coreclr\Windows_NT.x64.Release\src\jit\standalone\Release\clrjit.pdb

Imports

kernel32

RaiseException
DebugBreak
OutputDebugStringA
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryThreadCycleTime
GetCurrentThread
HeapFree
GetLastError
GetCurrentThreadId
GetSystemTimeAsFileTime
FreeLibrary
SetLastError
LoadLibraryExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
RtlPcToFileHeader

api-ms-win-crt-math-l1-1-0

ceilf
ceil
sqrtf
_isnan
cos
_isnanf
_copysignf
_fdopen
_copysign
sqrt
sinf
_finite
sin
cosf
floor
fmod
floorf

api-ms-win-crt-stdio-l1-1-0

fclose
fseek
ftell
_fileno
__acrt_iob_func
_dup
_setmode
setvbuf
_wfopen
__stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

terminate
_invalid_parameter_noinfo
_cexit
_execute_onexit_table
_errno
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
abort

api-ms-win-crt-string-l1-1-0

strcpy_s
strcat_s
wcsncmp
strncmp
strcmp

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc

Exports

Exports

getJit
jitStartup

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypto-sniper-main/coreclr.dll
.dll windows:6 windows x64 arch:x64

928b5195a4e2f71947928a5a7bb539c3

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:3d:df:11:55:56:55:29:d0:b4:9a:11:07:85:ae:15:d0:f4:a2:10:06:5a:9a:bb:68:f0:4b:29:76:86:b9:d9
Signer

Actual PE Digest

fb:3d:df:11:55:56:55:29:d0:b4:9a:11:07:85:ae:15:d0:f4:a2:10:06:5a:9a:bb:68:f0:4b:29:76:86:b9:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\workspace\_work\1\s\artifacts\obj\coreclr\Windows_NT.x64.Release\src\dlls\mscoree\coreclr\Release\coreclr.pdb

Imports

kernel32

TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetTickCount
CreateFileMappingW
RtlAddFunctionTable
RtlDeleteFunctionTable
GetFileSize
FlushInstructionCache
RtlLookupFunctionEntry
HeapFree
InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount64
DuplicateHandle
QueueUserAPC
WaitForSingleObjectEx
SetThreadPriority
GetThreadPriority
ResumeThread
GetCurrentThreadId
Sleep
TlsAlloc
GetCurrentThread
CreateThread
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlCaptureContext
SetThreadStackGuarantee
VirtualQuery
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
MapViewOfFileEx
UnmapViewOfFile
GetStringTypeExW
SetEvent
GetCurrentProcessorNumber
GlobalMemoryStatusEx
CreateIoCompletionPort
PostQueuedCompletionStatus
SleepEx
GetQueuedCompletionStatus
GetCurrentProcessorNumberEx
ExitProcess
GetActiveProcessorGroupCount
GetActiveProcessorCount
GetSystemTime
GetSystemTimeAsFileTime
CreateMemoryResourceNotification
GetProcessAffinityMask
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
GetLargePageMinimum
VirtualUnlock
GetLogicalProcessorInformation
SetThreadGroupAffinity
SetThreadAffinityMask
IsProcessInJob
QueryInformationJobObject
K32GetProcessMemoryInfo
VirtualAlloc
VirtualFree
VirtualProtect
SwitchToThread
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateEventW
ResetEvent
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexW
RaiseFailFastException
GetThreadContext
SuspendThread
SetThreadContext
GetEnabledXStateFeatures
InitializeContext
SetXStateFeaturesMask
GetSystemDefaultLCID
GetUserDefaultLCID
RtlInstallFunctionTableCallback
RtlUnwind
HeapAlloc
GetProcessHeap
HeapCreate
HeapDestroy
FormatMessageW
GetACP
LCMapStringEx
IsDBCSLeadByte
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetModuleFileNameW
VirtualAllocExNuma
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
GetLogicalProcessorInformationEx
GetThreadGroupAffinity
GetSystemTimes
CreateProcessW
GetCPInfo
LoadLibraryExW
CreateFileW
GetFileAttributesExW
GetCurrentDirectoryW
GetFullPathNameW
OpenProcess
OpenEventW
ExitThread
HeapReAlloc
CreateNamedPipeA
WaitForMultipleObjects
DisconnectNamedPipe
CreateFileA
CancelIoEx
GetOverlappedResult
CreateEventA
ConnectNamedPipe
FlushFileBuffers
MapViewOfFile
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
SetConsoleCtrlHandler
GetLocaleInfoEx
GetUserDefaultLocaleName
InitializeCriticalSectionAndSpinCount
RtlVirtualUnwind
IsProcessorFeaturePresent
RtlUnwindEx
EncodePointer
TlsFree
RtlPcToFileHeader
GetCurrentProcessId
RaiseException
WaitForSingleObject
RtlRestoreContext
TlsSetValue
TlsGetValue
SetLastError
FreeLibrary
GetModuleHandleW
GetSystemInfo
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
InitializeCriticalSection
InterlockedPopEntrySList
WriteFile
GetProcessTimes
GetCommandLineW
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleExW
SetErrorMode
CloseHandle
GetCurrentProcess
FlushProcessWriteBuffers
OutputDebugStringW
DebugBreak
LoadLibraryExA
MultiByteToWideChar
ReleaseMutex

advapi32

RegisterEventSourceW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
DeregisterEventSource
ReportEventW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
EventRegister
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
SetThreadToken
RevertToSelf
OpenThreadToken
EventWriteTransfer
EventWrite
SetKernelObjectSecurity

ole32

CoCreateFreeThreadedMarshaler
StringFromGUID2
CoGetContextToken
CoGetObjectContext
CoUnmarshalInterface
CoMarshalInterface
CoGetClassObject
CreateStreamOnHGlobal
IIDFromString
CoReleaseMarshalData
CLSIDFromProgID
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoRevokeInitializeSpy
CoGetMarshalSizeMax

oleaut32

CreateErrorInfo
LoadRegTypeLi
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringByteLen
SysStringByteLen
SafeArrayGetRecordInfo
SafeArrayGetElemsize
SafeArrayAllocData
SafeArraySetRecordInfo
GetRecordInfoFromTypeInfo
SafeArrayAllocDescriptorEx
VarCyFromDec
VariantInit
VariantClear
VariantChangeTypeEx
VariantChangeType
SafeArrayGetVartype
LoadTypeLibEx
QueryPathOfRegTypeLi
SetErrorInfo
SysFreeString
GetErrorInfo
SysAllocString
SysStringLen
SysAllocStringLen
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayDestroy

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

strncmp
strncat_s
wcsncat_s
strcpy_s
wcscpy_s
wcsncpy
wcsncpy_s
strtok_s
iswascii
wcscmp
wcscat_s
towupper
strlen
strncpy_s
towlower
iswspace
strcmp
strnlen
strcat_s
wcsncmp
_wcsicmp
iswupper
_wcsnicmp
_strnicmp
_stricmp
isalpha
wcsnlen
isdigit

api-ms-win-crt-convert-l1-1-0

_wtoi
wcstoul
strtoul
_ltow_s
_wcstoui64
_atoi64
atol
_itow_s

api-ms-win-crt-stdio-l1-1-0

_wfopen_s
__stdio_common_vfprintf
fflush
fopen
__stdio_common_vsprintf_s
_flushall
__stdio_common_vsnprintf_s
__stdio_common_vfwprintf
fputs
__stdio_common_vsnwprintf_s
fwrite
_putws
__stdio_common_vswprintf_s
_wfopen
__stdio_common_vsscanf
fgets
fclose
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_errno
terminate
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
abort
_invalid_parameter_noinfo
_controlfp_s

api-ms-win-crt-utility-l1-1-0

qsort
bsearch

api-ms-win-crt-math-l1-1-0

tanf
tanh
sinhf
sinh
sinf
cosh
cosf
sin
cos
ceilf
ceil
atanf
atan2f
atan2
powf
asinf
asin
acosf
acos
pow
logf
tan
log10f
log10
log
fmodf
fmod
log2f
scalbnf
acoshf
cbrtf
atanhf
fmaf
ilogbf
asinhf
asinh
cbrt
ilogb
fma
acosh
scalbn
floor
atanh
expf
log2
exp
atan
modff
modf
_finite
_isnan
_copysign
coshf
tanhf

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s
_wsplitpath_s

Exports

Exports

CLRJitAttachState
GetCLRRuntimeHost
MetaDataGetDispenser
coreclr_create_delegate
coreclr_execute_assembly
coreclr_initialize
coreclr_shutdown
coreclr_shutdown_2
g_CLREngineMetrics

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CLR_UEF
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 755KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
crypto-sniper-main/crypto-token-sniper.exe
.exe windows:5 windows x64 arch:x64

ba5546933531fafa869b1f86a4e2a959

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcAddress
GetModuleFileNameW
SetDllDirectoryW
FreeLibrary
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
SetEndOfFile

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pow.pyc
crypto-sniper-main/mscordaccore.dll
.dll windows:6 windows x64 arch:x64

89d95008a9b2af1f7f34931c92913790

Code Sign

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:24

Not After

02/12/2021, 21:24

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:03:f0:70:fa:c9:51:1c:cb:8f:fd:3e:60:61:0d:ce:5f:45:47:93:74:d2:77:d5:a4:e9:4e:fe:e4:a2:c1:68
Signer

Actual PE Digest

41:03:f0:70:fa:c9:51:1c:cb:8f:fd:3e:60:61:0d:ce:5f:45:47:93:74:d2:77:d5:a4:e9:4e:fe:e4:a2:c1:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\workspace\_work\1\s\artifacts\obj\coreclr\Windows_NT.x64.Release\src\dlls\mscordac\Release\mscordaccore.pdb

Imports

kernel32

FreeLibrary
CloseHandle
GetCurrentProcess
FlushInstructionCache
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FlushFileBuffers
WriteFile
ReadFile
HeapFree
HeapDestroy
GetACP
LCMapStringEx
IsDBCSLeadByte
FormatMessageW
LocalFree
SleepEx
VirtualAlloc
VirtualFree
RaiseException
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
ReadProcessMemory
GetProcessAffinityMask
SwitchToThread
SetLastError
CreateSemaphoreExW
CreateEventW
WaitForSingleObjectEx
SetEvent
ReleaseSemaphore
LoadLibraryExW
CreateFileW
GetEnvironmentVariableW
GetFullPathNameW
IsDebuggerPresent
GetProcessHeap
HeapAlloc
GetSystemInfo
GetProcAddress
GetModuleHandleW
InitializeCriticalSection
DebugBreak
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentVariableA
WideCharToMultiByte
GetLastError
MultiByteToWideChar
DeleteCriticalSection
RtlPcToFileHeader
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ResetEvent
InitializeCriticalSectionAndSpinCount

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoTaskMemFree
CoCreateGuid
IIDFromString

oleaut32

CreateErrorInfo
SetErrorInfo

user32

LoadStringW

api-ms-win-crt-string-l1-1-0

_wcslwr_s
wcscpy_s
wcsncpy_s
strnlen
strncmp
strcmp
strcpy_s
strlen
strncat_s
wcsncat_s
wcsncmp
strncpy_s
wcscat_s
wcscmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
terminate
_seh_filter_dll
_initterm
_errno
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_configure_narrow_argv
abort
_invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free

api-ms-win-crt-convert-l1-1-0

wcstoul

Exports

Exports

CLRDataCreateInstance
DacDbiInterfaceInstance
OutOfProcessExceptionEventCallback
OutOfProcessExceptionEventDebuggerLaunchCallback
OutOfProcessExceptionEventSignatureCallback
OutOfProcessFunctionTableCallback
OutOfProcessFunctionTableCallbackEx

Sections

.text
Size: 815KB - Virtual size: 815KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c60dda7f0e42c4ab1a4510cd287d92f

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

b8:6f:df:5f:57:e7:36:0b:76:82:19:49:6f:18:41:b6:5e:c0:b9:85:15:26:5d:1c:a2:a4:d3:4f:f1:99:94:7eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 268KB - Virtual size: 267KB

.rdata Size: 445KB - Virtual size: 445KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 3KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 372B

683f62770505579f5d043e11a2df1dd0

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

b3:24:0f:e3:a8:93:59:21:3b:63:53:d8:dd:34:f1:d9:c8:99:fb:77:30:ca:fa:b9:1f:a5:f7:a7:98:cc:35:a0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 154KB - Virtual size: 153KB

.data Size: 512B - Virtual size: 9KB

.pdata Size: 40KB - Virtual size: 39KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

928b5195a4e2f71947928a5a7bb539c3

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

fb:3d:df:11:55:56:55:29:d0:b4:9a:11:07:85:ae:15:d0:f4:a2:10:06:5a:9a:bb:68:f0:4b:29:76:86:b9:d9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

oleaut32

user32

api-ms-win-crt-string-l1-1-0

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b8:6f:df:5f:57:e7:36:0b:76:82:19:49:6f:18:41:b6:5e:c0:b9:85:15:26:5d:1c:a2:a4:d3:4f:f1:99:94:7e
Signer

.text
Size: 268KB - Virtual size: 267KB

.rdata
Size: 445KB - Virtual size: 445KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 372B

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

b3:24:0f:e3:a8:93:59:21:3b:63:53:d8:dd:34:f1:d9:c8:99:fb:77:30:ca:fa:b9:1f:a5:f7:a7:98:cc:35:a0
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 154KB - Virtual size: 153KB

.data
Size: 512B - Virtual size: 9KB

.pdata
Size: 40KB - Virtual size: 39KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

fb:3d:df:11:55:56:55:29:d0:b4:9a:11:07:85:ae:15:d0:f4:a2:10:06:5a:9a:bb:68:f0:4b:29:76:86:b9:d9
Signer

.text
Size: 3.9MB - Virtual size: 3.9MB

.CLR_UEF
Size: 512B - Virtual size: 92B

.rdata
Size: 755KB - Virtual size: 754KB

.data
Size: 14KB - Virtual size: 99KB

.pdata
Size: 184KB - Virtual size: 183KB

.didat
Size: 512B - Virtual size: 56B

_RDATA
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 24KB - Virtual size: 24KB

.text
Size: 162KB - Virtual size: 162KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 3KB - Virtual size: 64KB

.pdata
Size: 8KB - Virtual size: 8KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 105KB - Virtual size: 105KB

.reloc
Size: 2KB - Virtual size: 1KB

33:00:00:03:de:8d:56:82:5a:f1:a4:a9:67:00:00:00:00:03:de
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

41:03:f0:70:fa:c9:51:1c:cb:8f:fd:3e:60:61:0d:ce:5f:45:47:93:74:d2:77:d5:a4:e9:4e:fe:e4:a2:c1:68
Signer

.text
Size: 815KB - Virtual size: 815KB

.rdata
Size: 159KB - Virtual size: 158KB

.data
Size: 4KB - Virtual size: 8KB

.pdata
Size: 34KB - Virtual size: 34KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB