Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_5ff7b16d0ff0a2200148b437295c5ab8_ekans_snatch.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-04_5ff7b16d0ff0a2200148b437295c5ab8_ekans_snatch.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-04_5ff7b16d0ff0a2200148b437295c5ab8_ekans_snatch
-
Size
4.8MB
-
MD5
5ff7b16d0ff0a2200148b437295c5ab8
-
SHA1
8fe6cd8a71939a661fb236067c091a7d1a461cdd
-
SHA256
3f55d5f8596634f157b43d7f649ba9de5f2d5c5b4bbc87a91297442b5bc32003
-
SHA512
ed47c785a7f5a2952699e7aca9a5d4e60c1702347ea33a1cc4d716653ab051345af02ac3b79df1c239afe90f1b9d6592544612920ecb7285269ac750c1135249
-
SSDEEP
49152:P0AzHyL7lZ5IQjhs7zhl1QviXvOWPEDM9lzCYzEpy3g9gddvmKFwZSthXV5yxWKK:PzzH87kgWsg98yPtmQD5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-04_5ff7b16d0ff0a2200148b437295c5ab8_ekans_snatch
Files
-
2024-05-04_5ff7b16d0ff0a2200148b437295c5ab8_ekans_snatch.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 206KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
/4 Size: 512B - Virtual size: 278B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/18 Size: 269KB - Virtual size: 268KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/30 Size: 210KB - Virtual size: 210KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/43 Size: 119KB - Virtual size: 118KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/59 Size: 192KB - Virtual size: 191KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/75 Size: 512B - Virtual size: 32B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/90 Size: 512B - Virtual size: 61B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/109 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 882B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 468KB - Virtual size: 467KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 683B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE