2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch
Size 24.7MB
Sample240612-w25fdsvekh
SHA256 3118301d1e8a265d92c26a56630a30575847534f2b3ecc3f4de5bc0627b6b4a2
MD5 11145f3c7b5280396dd8b36cc67267f1
SHA1 9c57ee77b39dcc05055c287dccd338bd8e7cf744
SHA512 6a5bb85f79bc65d1ea2841c49b1be3c25eb30a320f7c416eb2a862c1268d7e80fd52670cebccc8753f25bb0168fd3c060c04edeb6f6a1c0471031eae696cd1bd
SSDEEP 196608:eWOrf5mIzGtNYH8je1uqM+HHThsdVQBWG:eWCf5mAeNYH8sU+HzfB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch

File Explorer

2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch

.exe 24.7MB

2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch

IMPHASH ea509d361799935a94335b88f534a970
SHA256 3118301d1e8a265d92c26a56630a30575847534f2b3ecc3f4de5bc0627b6b4a2
MD5 11145f3c7b5280396dd8b36cc67267f1
SHA1 9c57ee77b39dcc05055c287dccd338bd8e7cf744
SHA512 6a5bb85f79bc65d1ea2841c49b1be3c25eb30a320f7c416eb2a862c1268d7e80fd52670cebccc8753f25bb0168fd3c060c04edeb6f6a1c0471031eae696cd1bd
SSDEEP 196608:eWOrf5mIzGtNYH8je1uqM+HHThsdVQBWG:eWCf5mAeNYH8sU+HzfB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

471680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

10.7MB

Virtual Size

10.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.3MB

Virtual Size

12.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

641KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

232KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

2024-06-12_11145f3c7b5280396dd8b36cc67267f1_snatch

kernel32

generic