General

  • Target

    SnapDownloader-1.15.7.exe

  • Size

    90.1MB

  • MD5

    fd9331a749e8db82b3ff68a85924511c

  • SHA1

    cc5cb5a1c9eee6428aed2d2424f58f0d792d0f20

  • SHA256

    56f10c7848d04e54bcbc16faa79b67e707583423b0c3aa8554f0d44b556aaaa6

  • SHA512

    92f567f4781438d002f19c4642bf2a694ac2d60e545ee046a62cb8128b0be9aea1b13169483e94fd58a1557c9064c4daa03e2eb30c165c081659c328b0dea4f0

  • SSDEEP

    1572864:398Ws6X5H4Mox7v707uXIJF1rmq66B/hr3ePX9bC99YN+QAtr5uZK:398WfJ/o57VXILZB1V3ePty9TRX

Score
3/10

Malware Config

Signatures

  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 30 IoCs

    Checks for missing Authenticode signature.

Files

  • SnapDownloader-1.15.7.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    0ef725341a4aecf8398c0e2132f38049


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WinShell.dll
    .dll windows:4 windows x86 arch:x86

    a75c904bad153f5af2c37cfdf66eba5c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/app-64.7z
    .7z
  • LICENSE.electron.txt
  • LICENSES.chromium.html
  • SnapDownloader.exe
    .exe windows:5 windows x64 arch:x64

    e05afeeca45c988089cb3355a2ab0a9f


    Headers

    Imports

    Exports

    Sections

  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    824d17f150756620b70aa929623006bb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    b8f7d0e0f83de4cae7f7fece4a2f750e


    Headers

    Imports

    Exports

    Sections

  • icudtl.dat
  • libEGL.dll
    .dll windows:5 windows x64 arch:x64

    473add2829e325fddbfbed09790ab4d8


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    6e04f7717f60bb0d7e3a45c8426282e1


    Headers

    Imports

    Exports

    Sections

  • locales/am.pak
  • locales/ar.pak
  • locales/bg.pak
  • locales/bn.pak
  • locales/ca.pak
  • locales/cs.pak
  • locales/da.pak
  • locales/de.pak
  • locales/el.pak
  • locales/en-GB.pak
  • locales/en-US.pak
  • locales/es-419.pak
  • locales/es.pak
  • locales/et.pak
  • locales/fa.pak
  • locales/fi.pak
  • locales/fil.pak
  • locales/fr.pak
  • locales/gu.pak
  • locales/he.pak
  • locales/hi.pak
  • locales/hr.pak
  • locales/hu.pak
  • locales/id.pak
  • locales/it.pak
  • locales/ja.pak
  • locales/kn.pak
  • locales/ko.pak
  • locales/lt.pak
  • locales/lv.pak
  • locales/ml.pak
  • locales/mr.pak
  • locales/ms.pak
  • locales/nb.pak
  • locales/nl.pak
  • locales/pl.pak
  • locales/pt-BR.pak
  • locales/pt-PT.pak
  • locales/ro.pak
  • locales/ru.pak
  • locales/sk.pak
  • locales/sl.pak
  • locales/sr.pak
  • locales/sv.pak
  • locales/sw.pak
  • locales/ta.pak
  • locales/te.pak
  • locales/th.pak
  • locales/tr.pak
  • locales/uk.pak
  • locales/vi.pak
  • locales/zh-CN.pak
  • locales/zh-TW.pak
  • resources.pak
  • resources/app-update.yml
  • resources/app.asar
  • resources/audio/download.mp3
  • resources/audio/download.wav
  • resources/audio/processed.mp3
  • resources/elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Headers

    Imports

    Sections

  • resources/win/dl/VCRUNTIME140.dll
    .dll windows:6 windows x64 arch:x64

    44c3854843f7a3fccdf8ddbbea66f302


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_asyncio.pyd
    .dll windows:6 windows x64 arch:x64

    4ea76361ab2b8d437d6c09f5c7beadf5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_bz2.pyd
    .dll windows:6 windows x64 arch:x64

    8f845c70b75bc8654eb7645081528fe0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_cffi_backend.cp38-win_amd64.pyd
    .dll windows:6 windows x64 arch:x64

    7af9e61aabc4c992e0bf3c1e38430910


    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_ctypes.pyd
    .dll windows:6 windows x64 arch:x64

    c0ced381de070b12789c4998d5be2bac


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_decimal.pyd
    .dll windows:6 windows x64 arch:x64

    89715ae1971fff1f57816ead74afe12f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_elementtree.pyd
    .dll windows:6 windows x64 arch:x64

    635e459169dcc88a8c4b88f942085253


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_hashlib.pyd
    .dll windows:6 windows x64 arch:x64

    745f844ef0e9eed502c60324816c9b56


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_lzma.pyd
    .dll windows:6 windows x64 arch:x64

    08e5172e901e3bc5a199c8467752ea42


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_multiprocessing.pyd
    .dll windows:6 windows x64 arch:x64

    819bb026d535d5bdb53fc3f361edcad2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_overlapped.pyd
    .dll windows:6 windows x64 arch:x64

    301c1cb608cb6c44dbb3b8091ac821a0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_queue.pyd
    .dll windows:6 windows x64 arch:x64

    ba9710738c5691ca592d4927b2412341


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_socket.pyd
    .dll .js windows:6 windows x64 arch:x64 polyglot

    fc6b55c57541344a8390f75ac5b20df1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_sqlite3.pyd
    .dll windows:6 windows x64 arch:x64

    46f34018b3f26ef124f647874492c1ae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/_ssl.pyd
    .dll windows:6 windows x64 arch:x64

    502afe528bdb7a2c24282a5f01ea8450


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/base_library.zip
    .zip
  • _bootlocale.pyc
  • _collections_abc.pyc
  • _weakrefset.pyc
  • abc.pyc
  • codecs.pyc
  • collections/__init__.pyc
  • collections/abc.pyc
  • copyreg.pyc
  • encodings/__init__.pyc
  • encodings/aliases.pyc
  • encodings/ascii.pyc
  • encodings/base64_codec.pyc
  • encodings/big5.pyc
  • encodings/big5hkscs.pyc
  • encodings/bz2_codec.pyc
  • encodings/charmap.pyc
  • encodings/cp037.pyc
  • encodings/cp1006.pyc
  • encodings/cp1026.pyc
  • encodings/cp1125.pyc
  • encodings/cp1140.pyc
  • encodings/cp1250.pyc
  • encodings/cp1251.pyc
  • encodings/cp1252.pyc
  • encodings/cp1253.pyc
  • encodings/cp1254.pyc
  • encodings/cp1255.pyc
  • encodings/cp1256.pyc
  • encodings/cp1257.pyc
  • encodings/cp1258.pyc
  • encodings/cp273.pyc
  • encodings/cp424.pyc
  • encodings/cp437.pyc
  • encodings/cp500.pyc
  • encodings/cp720.pyc
  • encodings/cp737.pyc
  • encodings/cp775.pyc
  • encodings/cp850.pyc
  • encodings/cp852.pyc
  • encodings/cp855.pyc
  • encodings/cp856.pyc
  • encodings/cp857.pyc
  • encodings/cp858.pyc
  • encodings/cp860.pyc
  • encodings/cp861.pyc
  • encodings/cp862.pyc
  • encodings/cp863.pyc
  • encodings/cp864.pyc
  • encodings/cp865.pyc
  • encodings/cp866.pyc
  • encodings/cp869.pyc
  • encodings/cp874.pyc
  • encodings/cp875.pyc
  • encodings/cp932.pyc
  • encodings/cp949.pyc
  • encodings/cp950.pyc
  • encodings/euc_jis_2004.pyc
  • encodings/euc_jisx0213.pyc
  • encodings/euc_jp.pyc
  • encodings/euc_kr.pyc
  • encodings/gb18030.pyc
  • encodings/gb2312.pyc
  • encodings/gbk.pyc
  • encodings/hex_codec.pyc
  • encodings/hp_roman8.pyc
  • encodings/hz.pyc
  • encodings/idna.pyc
  • encodings/iso2022_jp.pyc
  • encodings/iso2022_jp_1.pyc
  • encodings/iso2022_jp_2.pyc
  • encodings/iso2022_jp_2004.pyc
  • encodings/iso2022_jp_3.pyc
  • encodings/iso2022_jp_ext.pyc
  • encodings/iso2022_kr.pyc
  • encodings/iso8859_1.pyc
  • encodings/iso8859_10.pyc
  • encodings/iso8859_11.pyc
  • encodings/iso8859_13.pyc
  • encodings/iso8859_14.pyc
  • encodings/iso8859_15.pyc
  • encodings/iso8859_16.pyc
  • encodings/iso8859_2.pyc
  • encodings/iso8859_3.pyc
  • encodings/iso8859_4.pyc
  • encodings/iso8859_5.pyc
  • encodings/iso8859_6.pyc
  • encodings/iso8859_7.pyc
  • encodings/iso8859_8.pyc
  • encodings/iso8859_9.pyc
  • encodings/johab.pyc
  • encodings/koi8_r.pyc
  • encodings/koi8_t.pyc
  • encodings/koi8_u.pyc
  • encodings/kz1048.pyc
  • encodings/latin_1.pyc
  • encodings/mac_arabic.pyc
  • encodings/mac_centeuro.pyc
  • encodings/mac_croatian.pyc
  • encodings/mac_cyrillic.pyc
  • encodings/mac_farsi.pyc
  • encodings/mac_greek.pyc
  • encodings/mac_iceland.pyc
  • encodings/mac_latin2.pyc
  • encodings/mac_roman.pyc
  • encodings/mac_romanian.pyc
  • encodings/mac_turkish.pyc
  • encodings/mbcs.pyc
  • encodings/oem.pyc
  • encodings/palmos.pyc
  • encodings/ptcp154.pyc
  • encodings/punycode.pyc
  • encodings/quopri_codec.pyc
  • encodings/raw_unicode_escape.pyc
  • encodings/rot_13.pyc
  • encodings/shift_jis.pyc
  • encodings/shift_jis_2004.pyc
  • encodings/shift_jisx0213.pyc
  • encodings/tis_620.pyc
  • encodings/undefined.pyc
  • encodings/unicode_escape.pyc
  • encodings/utf_16.pyc
  • encodings/utf_16_be.pyc
  • encodings/utf_16_le.pyc
  • encodings/utf_32.pyc
  • encodings/utf_32_be.pyc
  • encodings/utf_32_le.pyc
  • encodings/utf_7.pyc
  • encodings/utf_8.pyc
  • encodings/utf_8_sig.pyc
  • encodings/uu_codec.pyc
  • encodings/zlib_codec.pyc
  • enum.pyc
  • functools.pyc
  • heapq.pyc
  • io.pyc
  • keyword.pyc
  • linecache.pyc
  • locale.pyc
  • operator.pyc
  • re.pyc
  • reprlib.pyc
  • sre_compile.pyc
  • sre_constants.pyc
  • sre_parse.pyc
  • tokenize.pyc
  • traceback.pyc
  • types.pyc
  • warnings.pyc
  • weakref.pyc
  • resources/win/dl/certifi/cacert.pem
  • resources/win/dl/curl_cffi-0.6.2.dist-info/INSTALLER
  • resources/win/dl/curl_cffi-0.6.2.dist-info/LICENSE
  • resources/win/dl/curl_cffi-0.6.2.dist-info/METADATA
  • resources/win/dl/curl_cffi-0.6.2.dist-info/RECORD
  • resources/win/dl/curl_cffi-0.6.2.dist-info/WHEEL
  • resources/win/dl/curl_cffi-0.6.2.dist-info/top_level.txt
  • resources/win/dl/curl_cffi/_wrapper.pyd
    .dll windows:6 windows x64 arch:x64

    46b7f595237c93416ec1e1d7d50ece97


    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/libcrypto-1_1.dll
    .dll windows:6 windows x64 arch:x64

    91e8dc4192e6f620254cd1fa32253e23


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/libcurl.dll
    .dll windows:4 windows x64 arch:x64

    f7eab9aac59726a14a97b641ec762d0c


    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/libffi-7.dll
    .dll windows:6 windows x64 arch:x64

    3dc8b86d60f90a1851eee5f9dc191312


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/libssl-1_1.dll
    .dll windows:6 windows x64 arch:x64

    4bc12a12006de71ec51afd066a728916


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/pyexpat.pyd
    .dll windows:6 windows x64 arch:x64

    520f09b5acd2ec3980f380734fb854af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/python3.dll
    .dll windows:6 windows x64 arch:x64


    Code Sign

    Headers

    Exports

    Sections

  • resources/win/dl/python38.dll
    .dll windows:6 windows x64 arch:x64

    c4d63c07192fd1e0ce0c4469257da0a2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/select.pyd
    .dll windows:6 windows x64 arch:x64

    8c968d0d6c409d355ea2f285004d6c73


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/snapdlbin.exe
    .exe windows:5 windows x64 arch:x64

    389e531b62f67eb598bee93bb6b28427


    Headers

    Imports

    Sections

  • __main__.pyc
  • resources/win/dl/sqlite3.dll
    .dll windows:6 windows x64 arch:x64

    2e54f6f5c641bbb521bb78e587832105


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/dl/unicodedata.pyd
    .dll windows:6 windows x64 arch:x64

    a1a40c0182b21e846adbbbe40bbef361


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/win/ffmpeg.exe
    .exe windows:4 windows x64 arch:x64

    d297e32ecde8c72f6a7ccad0a39d34a9


    Headers

    Imports

    Exports

    Sections

  • resources/win/pssuspend.exe
    .exe windows:5 windows x86 arch:x86

    6e9a261f58f47d82fb85893416a0d9b3


    Code Sign

    Headers

    Imports

    Sections

  • resources/win/pssuspend64.exe
    .exe windows:5 windows x64 arch:x64

    a6a32311420ceb9ef8a92cb8745dab9a


    Code Sign

    Headers

    Imports

    Sections

  • resources/win/snapdl2.exe
    .exe windows:5 windows x86 arch:x86

    985a7b86c383570b8555b38c1f270b55


    Headers

    Imports

    Exports

    Sections

  • resources/win/vcredist_10_x86.exe
    .exe windows:5 windows x86 arch:x86

    a1f6f100bff4507a3332f3f0cdfc24f5


    Code Sign

    Headers

    Imports

    Sections

  • snapshot_blob.bin
  • swiftshader/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    a9e49d20df10f15c9224d2a4846c15d0


    Headers

    Imports

    Exports

    Sections

  • swiftshader/libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    b5c118b9a0a05f5d83fe9e4a7ead581c


    Headers

    Imports

    Exports

    Sections

  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    67f00b743ca1ec813ecbc1dbb63211a2


    Headers

    Imports

    Exports

    Sections

  • vk_swiftshader_icd.json
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d31c5eb927119d00232e4d4b0e32fcdb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:6 windows x86 arch:x86

    2656ea25cde98f31a490513c2db04ae8


    Headers

    Imports

    Exports

    Sections

  • Uninstall SnapDownloader.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    0ef725341a4aecf8398c0e2132f38049


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WinShell.dll
    .dll windows:4 windows x86 arch:x86

    a75c904bad153f5af2c37cfdf66eba5c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d31c5eb927119d00232e4d4b0e32fcdb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections