Overview

overview

3

Static

static

3

SNOW.exe

windows7-x64

1

SNOW.exe

windows10-2004-x64

1

TaowaTools.exe

windows7-x64

1

TaowaTools.exe

windows10-2004-x64

1

crypt.py

windows7-x64

3

crypt.py

windows10-2004-x64

3

crypt.pyc

windows7-x64

3

crypt.pyc

windows10-2004-x64

3

cygiconv-2.dll

windows7-x64

3

cygiconv-2.dll

windows10-2004-x64

3

cygintl-2.dll

windows7-x64

1

cygintl-2.dll

windows10-2004-x64

1

cygjpeg-62.dll

windows7-x64

3

cygjpeg-62.dll

windows10-2004-x64

3

cygmcrypt-4.dll

windows7-x64

1

cygmcrypt-4.dll

windows10-2004-x64

1

cygmhash-2.dll

windows7-x64

1

cygmhash-2.dll

windows10-2004-x64

1

cygwin1.dll

windows7-x64

3

cygwin1.dll

windows10-2004-x64

3

cygz.dll

windows7-x64

3

cygz.dll

windows10-2004-x64

3

jsteg.exe

windows7-x64

1

jsteg.exe

windows10-2004-x64

1

lsb.py

windows7-x64

3

lsb.py

windows10-2004-x64

3

steghide.exe

windows7-x64

1

steghide.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    ad58c0561b4e43595a9b78e904f80db1d35fc1fb9287f1cd90a63ab6837ed81c

  • Size

    2.6MB

  • MD5

    db835135635b5f8fc885c694e7c3f40c

  • SHA1

    f11574594772a1bff52f39d3d4d2521e9656415b

  • SHA256

    ad58c0561b4e43595a9b78e904f80db1d35fc1fb9287f1cd90a63ab6837ed81c

  • SHA512

    f3ba1fe6f3c11b24354309805ecc1c4cae196af114502b47b759c7bf7d2f54d06b8ddad55db1a22e21ebd344d2f25bebefc2575b62b6487f9313118c69a79aaa

  • SSDEEP

    49152:X1GrBIC7u4QK/YTrvNbWmMuU4qycIv+CKXQo11yObUSqNktCttxkznGrreLQ:MysucgTzNWuQyck+vbyOFtCtjsOX

Score
3/10

Malware Config

Signatures

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

Files

  • ad58c0561b4e43595a9b78e904f80db1d35fc1fb9287f1cd90a63ab6837ed81c
    .zip
  • SNOW.EXE
    .exe windows:4 windows x86 arch:x86

    0bdd493f02586a65baea09e06ddc0769


    Headers

    Imports

    Sections

  • TaowaTools.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TaowaTools.exe.config
    .xml
  • TaowaTools.pdb
  • crypt.py
  • crypt.pyc
  • cygiconv-2.dll
    .dll windows:4 windows x86 arch:x86

    6c5a1464135cd11ca179056ae7203ee2


    Headers

    Imports

    Exports

    Sections

  • cygintl-2.dll
    .dll windows:4 windows x86 arch:x86

    6f2f5821b45fc52bc43e1defed443b82


    Headers

    Imports

    Exports

    Sections

  • cygjpeg-62.dll
    .dll windows:4 windows x86 arch:x86

    6993c9e5a767b1f8eac8abd60b5bb86f


    Headers

    Imports

    Exports

    Sections

  • cygmcrypt-4.dll
    .dll windows:4 windows x86 arch:x86

    f3026a5cb7f2ff2dcb810dfb890b5cea


    Headers

    Imports

    Exports

    Sections

  • cygmhash-2.dll
    .dll windows:4 windows x86 arch:x86

    2a7fe0ce403e506f483d1f7d39cf496d


    Headers

    Imports

    Exports

    Sections

  • cygwin1.dll
    .dll windows:4 windows x86 arch:x86

    ed7aeeb3bf97d5d41ab0e5302832373c


    Headers

    Imports

    Exports

    Sections

  • cygz.dll
    .dll windows:4 windows x86 arch:x86

    e5d137004ca5800366d38a3ecb91ab77


    Headers

    Imports

    Exports

    Sections

  • jsteg.exe
    .exe windows:4 windows x64 arch:x64

    96c44fa1eee2c4e9b9e77d7bf42d59e6


    Headers

    Imports

    Sections

  • locale/de/LC_MESSAGES/steghide.mo
  • locale/es/LC_MESSAGES/steghide.mo
  • locale/fr/LC_MESSAGES/steghide.mo
  • locale/ro/LC_MESSAGES/steghide.mo
  • lsb.py
  • steghide.exe
    .exe windows:4 windows x86 arch:x86

    c7aa6c64ded2a65ec3ad42d6aa26c8ac


    Headers

    Imports

    Sections

  • tables/1CB4
  • tables/1CB5
  • tables/1CB6
  • tables/1TH4
  • tables/1TH5
  • tables/1TH6
  • tables/1cb0
  • tables/1cb1
  • tables/1cb2
  • tables/1th0
  • tables/1th1
  • tables/1th2
  • tables/2CB4
  • tables/2CB5
  • tables/2CB6
  • tables/2TH4
  • tables/2TH5
  • tables/2TH6
  • tables/2cb0
  • tables/2cb1
  • tables/2cb2
  • tables/2th0
  • tables/2th1
  • tables/2th2
  • tables/ALLOC_4
  • tables/HUFFCODE
  • tables/PSY_DATA
  • tables/absthr_0
  • tables/absthr_1
  • tables/absthr_2
  • tables/alloc_0
  • tables/alloc_1
  • tables/alloc_2
  • tables/alloc_3
  • tables/dewindow
  • tables/enwindow
  • tables/huffdec
  • tsharkpath.txt