sniper_sideloader.zip
- SHA256 b5a50ef1c3a8d0b82ecda161a229f9844cd84dbb640df507e83f26725188e0a0
Overview
overview
10Static
static
5VCRUNTIME140.dll
windows10-2004-x64
1VCRUNTIME140.dll
windows11-ltsc_2024-x64
1VCRUNTIME140_1.dll
windows10-2004-x64
1VCRUNTIME140_1.dll
windows11-ltsc_2024-x64
1glib-2.0.dll
windows10-2004-x64
8glib-2.0.dll
windows11-ltsc_2024-x64
8gmodule-2.0.dll
windows10-2004-x64
8gmodule-2.0.dll
windows11-ltsc_2024-x64
8gobject-2.0.dll
windows10-2004-x64
8gobject-2.0.dll
windows11-ltsc_2024-x64
8intl.dll
windows10-2004-x64
8intl.dll
windows11-ltsc_2024-x64
8pcre.dll
windows10-2004-x64
1pcre.dll
windows11-ltsc_2024-x64
1sniper.exe
windows10-2004-x64
8sniper.exe
windows11-ltsc_2024-x64
8vmtools.dll
windows10-2004-x64
8vmtools.dll
windows11-ltsc_2024-x64
10Static task
static1
Behavioral task
behavioral1
Sample
VCRUNTIME140.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
VCRUNTIME140.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
VCRUNTIME140_1.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
VCRUNTIME140_1.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
glib-2.0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
glib-2.0.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
gmodule-2.0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
gmodule-2.0.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
gobject-2.0.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
gobject-2.0.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
intl.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
intl.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
pcre.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
pcre.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
sniper.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
sniper.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
vmtools.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
vmtools.dll
Resource
win11ltsc2024-20260911-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/intl.dll |
| unpack001/intl.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/intl.dll |
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=1, productName=Unmarked objects,
count=12, id=259, version=26706,
count=16, id=260, version=26706,
count=31, id=261, version=26706,
count=1, id=256, version=26706,
count=1, id=255, version=26706,
count=1, id=258, version=26706,
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=30795,
count=2, id=257, version=35207,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=53, id=1, productName=Unmarked objects,
count=7, id=260, version=35207,
count=27, id=261, version=35207,
count=5, id=259, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=6, id=199, version=41118,
count=3, id=259, version=26706,
count=11, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=2, id=257, productName=VS2019 v16.7.1 build 29111, version=29111,
count=13, id=257, version=25711,
count=253, id=1, productName=Unmarked objects,
count=91, id=264, version=26729,
count=1, id=256, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=255, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.8.4 build 26729, version=26729,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=1, id=199, version=41118,
count=2, id=259, version=26706,
count=11, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=3, id=257, version=25711,
count=72, id=1, productName=Unmarked objects,
count=1, id=264, version=26729,
count=1, id=256, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=255, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.8.4 build 26729, version=26729,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=2, id=259, version=26706,
count=11, id=261, version=26706,
count=7, id=260, version=26706,
count=3, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=259, version=25711,
count=1, id=260, version=25711,
count=2, id=257, version=25711,
count=206, id=1, productName=Unmarked objects,
count=3, id=260, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=259, productName=VS2019 v16.4.3 build 28315, version=28315,
count=18, id=264, version=26729,
count=1, id=256, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=255, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.8.4 build 26729, version=26729,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=28920,
count=11, id=261, version=28920,
count=8, id=260, version=28920,
count=4, id=259, version=28920,
count=3, id=257, version=27412,
count=60, id=1, productName=Unmarked objects,
count=21, id=264, version=29111,
count=1, id=256, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=255, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=1, id=253, version=28518,
count=2, id=257, productName=VS2019 v16.11.1 build 30133, version=30133,
count=6, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=2, id=257, productName=VS2019 v16.2.3 build 27905, version=27905,
count=25, id=261, version=30034,
count=10, id=260, version=30034,
count=3, id=259, version=30034,
count=13, id=257, version=28900,
count=317, id=1, productName=Unmarked objects,
count=11, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=2, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=5, id=253, version=28518,
count=2, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=13, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=2, id=260, version=28900,
count=19, id=257, version=28900,
count=648, id=1, productName=Unmarked objects,
count=2, id=259, productName=VS2019 v16.11.1 build 30133, version=30133,
count=4, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,
count=198, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=256, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,