sniffcraft-windows-26[.]1[.]2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
sniffcraft-windows-26.1.2.exe
Size 5.8MB
Sample260623-2ja2qagy2y
SHA256 4ee3e375c6cf6c962b277bd9e172a9e71d310997e1330734ab111184f7748171
MD5 8bef1685b8a552ffd7d01a80bdebecd3
SHA1 7569b31b9dd88645ac55f4f9bb738cc5a3888e18
SHA512 7057f58b819c3daad1fce06d2e91983b657a4cf5f2b3d7b89d6ff53a3d5f3a211370abf9d1799333b24edf33850185154e886f18c35c67c41a5a9ede2835976a
SSDEEP 49152:ztZq8vYqLHhiHERAujrIkbnLMtjtJonCN7eaSd/p7WB+Wib7N8VlNEg+A/KsZ6MQ:/vqlrK/BW3ibMzz7AAauujpQ2T
TLSH
T1FA567E26B23922ECC0B6C1BDDB879417E6F374880771ABEF0A6245261F235D59D7FA10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sniffcraft-windows-26.1.2.exe

File Explorer

sniffcraft-windows-26.1.2.exe

.exe 5.8MB

sniffcraft-windows-26.1.2.exe

IMPHASH 278eb05fc538f65f50b78163fb45b344
SHA256 4ee3e375c6cf6c962b277bd9e172a9e71d310997e1330734ab111184f7748171
MD5 8bef1685b8a552ffd7d01a80bdebecd3
SHA1 7569b31b9dd88645ac55f4f9bb738cc5a3888e18
SHA512 7057f58b819c3daad1fce06d2e91983b657a4cf5f2b3d7b89d6ff53a3d5f3a211370abf9d1799333b24edf33850185154e886f18c35c67c41a5a9ede2835976a
SSDEEP 49152:ztZq8vYqLHhiHERAujrIkbnLMtjtJonCN7eaSd/p7WB+Wib7N8VlNEg+A/KsZ6MQ:/vqlrK/BW3ibMzz7AAauujpQ2T
TLSH
T1FA567E26B23922ECC0B6C1BDDB879417E6F374880771ABEF0A6245261F235D59D7FA10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3672272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glClear

kernel32

TlsFree LocalFree FormatMessageA CancelIoEx CreateWaitableTimerA MultiByteToWideChar GetSystemTime SystemTimeToFileTime GetCurrentThreadId SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileA FindNextFileA GetModuleHandleExA GetStdHandle GetFileType WriteFile GetModuleHandleA GetProcAddress ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeLibrary LoadLibraryA GetEnvironmentVariableW WideCharToMultiByte GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency InitializeCriticalSection VerSetConditionMask GetModuleHandleExW FormatMessageW Sleep GetStartupInfoW GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetThreadExecutionState WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation DeleteFileW SetStdHandle SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapQueryInformation HeapSize HeapReAlloc HeapFree HeapAlloc UnhandledExceptionFilter TlsGetValue RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetModuleFileNameW IsProcessorFeaturePresent TerminateProcess ExitProcess GetCurrentProcess ReadFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW CreateFileW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlLookupFunctionEntry RtlUnwindEx InitializeSListHead SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx AcquireSRWLockShared ReleaseSRWLockShared GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFullPathNameW TlsAlloc TerminateThread QueueUserAPC WaitForMultipleObjects SetWaitableTimer CreateEventW SleepEx WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind LeaveCriticalSection EnterCriticalSection GetFileInformationByHandle GetFileAttributesExW FindNextFileW PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetLastError FindFirstFileExW FindFirstFileW GetCurrentDirectoryW GetLocaleInfoEx RaiseException RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread SwitchToThread WaitForSingleObjectEx TlsSetValue GetLastError CloseHandle SetEndOfFile IsDebuggerPresent

user32

RegisterDeviceNotificationW UnregisterDeviceNotification DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow ToUnicode DispatchMessageW DestroyIcon GetDC ReleaseDC ChangeDisplaySettingsExW EnumDisplaySettingsW EnumDisplaySettingsExW EnumDisplayDevicesW GetMonitorInfoW EnumDisplayMonitors TrackMouseEvent GetMessageTime SendMessageW PostMessageW WaitMessage GetLayeredWindowAttributes PeekMessageW TranslateMessage MessageBoxA GetUserObjectInformationW GetProcessWindowStation MapVirtualKeyW SetLayeredWindowAttributes SetWindowLongPtrW GetWindowLongPtrW GetPropA SetPropA CallWindowProcW GetMessageExtraInfo GetRawInputDeviceList GetRawInputDeviceInfoA RegisterRawInputDevices GetRawInputData MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect OffsetRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetWindowRect GetClientRect SetWindowTextW RemovePropW GetPropW SetPropW SetForegroundWindow GetSystemMetrics MsgWaitForMultipleObjects ReleaseCapture SetCapture GetKeyState GetActiveWindow SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed BringWindowToTop IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos MoveWindow FlashWindow

gdi32

GetDeviceGammaRamp GetDeviceCaps DeleteDC SetPixelFormat SetDeviceGammaRamp SwapBuffers DescribePixelFormat ChoosePixelFormat CreateDIBSection DeleteObject CreateRectRgn CreateBitmap CreateDCW

shell32

DragQueryFileW DragQueryPoint ShellExecuteW DragAcceptFiles DragFinish

advapi32

RegisterEventSourceA ReportEventA DeregisterEventSource

ws2_32

closesocket connect ioctlsocket getsockopt select setsockopt WSAStartup WSACleanup WSASetLastError WSAGetLastError WSASend WSASocketW getaddrinfo freeaddrinfo WSARecv bind htonl htons listen ntohl WSARecvFrom WSASendTo WSAStringToAddressW send recv

mswsock

AcceptEx GetAcceptExSockaddrs

bcrypt

BCryptGenRandom

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

164KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

sniffcraft-windows-26.1.2.exe

opengl32

kernel32

user32

gdi32

shell32

advapi32

ws2_32

mswsock

bcrypt

imm32

generic