Ultimate Sniff[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Ultimate Sniff.exe
Size 97.7MB
Sample260801-e98z4sdg49
SHA256 dd135039cdca3c1577df860983ab9e7959dd18c64dfa228bccbafc6f23b95fa8
MD5 ed929a46f5c0f945333ce75d8207011a
SHA1 3c39ea7ffc583120ce98f40bcf6b865f29a926ef
SHA512 ad66510dfb58bcd5cb67d34badce0c7f535c4781bf4b661bfd61dd09d17c9ff6c208cff82584d67318810670ab40c1055a14127f75a622cd4d72006739f832f0
SSDEEP 24576:PnzGYsKvc1Bss+b9R8OlgBcqqAVWubSNQjG5:P1s6c1mtb9R8OKBBWrqG5
TLSH
T1CD281213FF5190BCE442C4788215A673A5B6B89B8B212EFB43544E307D25BF46F3DA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ultimate Sniff.exe

File Explorer

Ultimate Sniff.exe

.exe 97.7MB

Ultimate Sniff.exe

IMPHASH c285d2b4cfd98dec19557666ca4bee90
SHA256 dd135039cdca3c1577df860983ab9e7959dd18c64dfa228bccbafc6f23b95fa8
MD5 ed929a46f5c0f945333ce75d8207011a
SHA1 3c39ea7ffc583120ce98f40bcf6b865f29a926ef
SHA512 ad66510dfb58bcd5cb67d34badce0c7f535c4781bf4b661bfd61dd09d17c9ff6c208cff82584d67318810670ab40c1055a14127f75a622cd4d72006739f832f0
SSDEEP 24576:PnzGYsKvc1Bss+b9R8OlgBcqqAVWubSNQjG5:P1s6c1mtb9R8OKBBWrqG5
TLSH
T1CD281213FF5190BCE442C4788215A673A5B6B89B8B212EFB43544E307D25BF46F3DA1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExW

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlNtStatusToDosError NtWriteFile

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpCloseHandle WinHttpReadData

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter ExitProcess HeapAlloc WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle WideCharToMultiByte ReleaseMutex CreateMutexA lstrlenW GetProcAddress LoadLibraryA GetCurrentThread GetModuleHandleA GetProcessHeap HeapFree GetCurrentProcess GetCurrentProcessId CreateToolhelp32Snapshot Module32First Module32Next CloseHandle GetTickCount IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentThreadId OpenThread GetThreadContext Process32First Process32Next AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateThread SetEnvironmentVariableW GetTempPathW GetEnvironmentVariableW CreateFileW WriteFile DeleteFileW SetFileAttributesW CreateProcessW ResumeThread WaitForSingleObject MoveFileExW GetModuleFileNameW Sleep HeapReAlloc SetThreadStackGuarantee GetLastError SetLastError GetCurrentDirectoryW WaitForSingleObjectEx GetModuleHandleW

user32

MessageBoxW GetWindowTextA EnumWindows

vcruntime140

__C_specific_handler memmove __CxxFrameHandler3 memcpy memset __current_exception_context __current_exception memcmp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm_e __p___argc __p___argv _cexit _seh_filter_exe _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _c_exit _set_app_type _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free