Sneaky_Loader (2)[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Sneaky_Loader (2).zip
Size 1.2MB
Sample260714-trd5caaz3y
SHA256 6a96acf0757f0c2c7fe075d7fbf8e729353c27fe3cf6b84eeee60a5ed2ec71cd
MD5 6daa8b97932a9b34a9ebfcfce678a13b
SHA1 cbcf133da5a09f3eb70ba50f0a96d5979770cac6
SHA512 cae62c26a2c8550906b0a5d0be46f5cbb093c7ec97a2480d6ed9ec5175afe164ad10aec140bf8845d870553a7836d60cdccaba1ccda2f84c319c720836ba62d1
SSDEEP 24576:6sTFcUXNBiPGch9sdyma8qB0jOfzqJUTZ83VNoJlvnXULHBAzQRZd5zCVmXFeFl5:DjiBh9sdzalB06fWJlclvnELazQvd5Do
TLSH
T1475533844C3ABE9B7BE337E534900DC61674533F8E7DAF03816529A966542DB503BC93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Sneaky_Loader.exe

File Explorer

Sneaky_Loader (2).zip

.zip 1.2MB
Sneaky_Loader.exe

.exe 2.3MB

Sneaky_Loader (2).zip

SHA256 6a96acf0757f0c2c7fe075d7fbf8e729353c27fe3cf6b84eeee60a5ed2ec71cd
MD5 6daa8b97932a9b34a9ebfcfce678a13b
SHA1 cbcf133da5a09f3eb70ba50f0a96d5979770cac6
SHA512 cae62c26a2c8550906b0a5d0be46f5cbb093c7ec97a2480d6ed9ec5175afe164ad10aec140bf8845d870553a7836d60cdccaba1ccda2f84c319c720836ba62d1
SSDEEP 24576:6sTFcUXNBiPGch9sdyma8qB0jOfzqJUTZ83VNoJlvnXULHBAzQRZd5zCVmXFeFl5:DjiBh9sdzalB06fWJlclvnELazQvd5Do
TLSH
T1475533844C3ABE9B7BE337E534900DC61674533F8E7DAF03816529A966542DB503BC93
MD5 SHA1 SHA512 SSDEEP TLSH

Sneaky_Loader.exe

IMPHASH e1a41b7cacf259c1885e764da477d3b0
SHA256 e710ba46f2a067c06f30ed3b8b1e911189ee2d01c18cf4182d9e1f1f3d501d3f
MD5 304c04f281802af17396094926cad718
SHA1 a04a0ea833f8594f5dde624e3235cccdf2942925
SHA512 4a2b697227818358f2f9642825d5a13842c69ed947c5d9eeaaece56235df94720e6232e2a4df8e7affee922631cf7ed3fbd7cf0475d2b79bc9fc43b849539b6a
SSDEEP 49152:eLv16GpTp/jD2uteRVpTNdljvwZDZe1V0Erv2naBMNCDudkuX:e166p0RVpTNdljvwZDZe13yNCDcr
TLSH
T1F3B5AE07A3A100DCC26FD5788626CB03EB72B858932197CB77D846951F17AE86E3F6D1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1094960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sneak\OneDrive\Desktop\Loader and external\CUSTOM LOADER\Baikzz Flammed Loader dx11\best-imgui-free-loader-Flammed-master\x64\Release\Framework.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW CreateProcessW FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileW FindFirstFileExW GetModuleFileNameW OpenThread K32EnumProcessModules CreateProcessA GlobalMemoryStatusEx GetCurrentProcessId ExitProcess GetThreadContext K32EnumProcesses CreateThread GetSystemInfo RaiseException K32GetModuleBaseNameA FindNextFileW GetFileAttributesExW GetCurrentThread QueryFullProcessImageNameA SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW K32GetModuleFileNameExA OpenProcess WaitForSingleObject Thread32First Thread32Next TerminateProcess VirtualProtect SetHandleInformation GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW OutputDebugStringA GetModuleFileNameA GetComputerNameA LocalFree GetFileAttributesA GetLastError Sleep FindClose FindNextFileA FindFirstFileA CheckRemoteDebuggerPresent IsDebuggerPresent GetTickCount K32GetModuleInformation CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot GetCurrentProcess LoadLibraryW QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GetExitCodeProcess GlobalFree GlobalAlloc MultiByteToWideChar GetFileSizeEx CreateFileW

user32

ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture ScreenToClient OpenClipboard SetCursorPos GetCursorPos CloseClipboard EmptyClipboard MoveWindow ShowWindow GetWindowRect UpdateWindow PostQuitMessage TranslateMessage SetLayeredWindowAttributes PeekMessageW SetWindowLongA DispatchMessageW RegisterClassExW GetKeyState GetClipboardData SetClipboardData GetSystemMetrics MessageBoxA FindWindowA GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW

advapi32

CryptEncrypt CryptImportKey CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash ConvertSidToStringSidA CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA GetUserNameA CryptAcquireContextW CheckTokenMembership FreeSid AllocateAndInitializeSid GetCurrentHwProfileA CryptDestroyKey SystemFunction036 OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance

msvcp140

?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Query_perf_frequency ?_Random_device@std@@YAIXZ _Query_perf_counter ?_Winerror_map@std@@YAHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Xbad_function_call@std@@YAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A __crtLCMapStringA ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Mtx_lock _Strcoll _Cnd_do_broadcast_at_thread_exit _Thrd_id _Xtime_get_ticks _Thrd_join _Mtx_unlock ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFreeCertificateContext CryptStringToBinaryW CryptStringToBinaryA CryptUnprotectData CertOpenStore CertCloseStore

wininet

HttpOpenRequestA InternetOpenUrlA HttpAddRequestHeadersA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetSetOptionA HttpQueryInfoA

psapi

GetModuleInformation

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGenRandom BCryptDestroyKey

urlmon

URLDownloadToFileW

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException memchr memcmp strrchr memmove memset wcschr __current_exception memcpy __std_type_info_compare __current_exception_context __std_exception_destroy __std_exception_copy __std_terminate strstr __RTtypeid strchr __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fputs feof _read fseek fclose fread __stdio_common_vsnprintf_s _wopen _popen __stdio_common_vsscanf fgets __p__commode _lseeki64 fflush _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos _write _fileno _close fgetc __stdio_common_vsprintf_s __acrt_iob_func ftell _pclose _set_fmode fputc

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-heap-l1-1-0

malloc free calloc _callnewh realloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoll strtoul wcstombs atoi strtod strtol strtoull

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _configure_narrow_argv terminate _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _invalid_parameter_noinfo_noreturn _errno _crt_atexit _cexit _seh_filter_exe _resetstkoflw _set_app_type _invalid_parameter_noinfo abort _get_narrow_winmain_command_line system __sys_nerr __sys_errlist _register_thread_local_exe_atexit_callback _c_exit _initterm _exit _initterm_e exit

api-ms-win-crt-string-l1-1-0

wcsncpy toupper strpbrk _stricmp isspace wcsncmp _wcsdup _strdup strcspn strncpy strncmp wcspbrk strspn strcmp tolower strlen strncpy_s wcslen

api-ms-win-crt-time-l1-1-0

_gmtime64 _localtime64 _time64 strftime _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _lock_file _fstat64 _wstat64

api-ms-win-crt-math-l1-1-0

fmodf __setusermatherr cosf sin _dsign powf cos sinf ceilf sqrtf _fdopen acosf

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_locale_name_func _configthreadlocale ___lc_collate_cp_func ___lc_codepage_func

ws2_32

listen accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname htonl