Behavioral task
behavioral1
Sample
2024-05-24_457ea8711b7a8add8f42519a2c80ccfb_snatch.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_457ea8711b7a8add8f42519a2c80ccfb_snatch.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-24_457ea8711b7a8add8f42519a2c80ccfb_snatch
-
Size
17.9MB
-
MD5
457ea8711b7a8add8f42519a2c80ccfb
-
SHA1
b5c4c78d33763d31839461b52e09bcb173bb15d5
-
SHA256
7b29ce1956336a26ca73c5c3ddd01d4f90ea667dad291cddf96aedfd30ee8eca
-
SHA512
27c8a29a3c403358798be4a18979152540303e9939b6080a15b14b9c46fd6f21b1906ee52ad50b17069a20107cf48be0510dcff647f53b16b46c0665aad63169
-
SSDEEP
196608:btrt3j8FC2IhMI7/5Xu0HINE/Cli0esf:Ft4C/RrIN63e
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-24_457ea8711b7a8add8f42519a2c80ccfb_snatch
Files
-
2024-05-24_457ea8711b7a8add8f42519a2c80ccfb_snatch.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 12.7MB - Virtual size: 12.7MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 542KB - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE