SneakyExternal[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SneakyExternal.exe
Size 4.1MB
Sample261003-ywph4axyfv
SHA256 37f3d8187143e041a1e4dd8c54917d6197869af3ee1bff9ac2b698a533a00325
MD5 c6aa772dfdf70f81205c7bd8dc0f59b5
SHA1 b6e462873af6bc62b03d8ba79936b4650afd16a1
SHA512 a526580965ae3862d9ea210c9fd0291954f646f6892dd930658212a578d02e30b988aacced9157ba35c32998c05ac4c92b8e8bd1399f647f1e3d05bf7b706db1
SSDEEP 98304:o2ZCcBaeEYzjVJ2GDqTkbAa/nxJtWTQ1Un:onGEYzjVJ2GDqAbpLWTQ
TLSH
T12916AE027A9A0098D162E63EE59F8F27EB31BC04073065D727D68B962F277D09E37B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SneakyExternal.exe

File Explorer

SneakyExternal.exe

.exe 4.1MB

SneakyExternal.exe

IMPHASH 55debcc6f8b8b91cfd8ce83afca381e3
SHA256 37f3d8187143e041a1e4dd8c54917d6197869af3ee1bff9ac2b698a533a00325
MD5 c6aa772dfdf70f81205c7bd8dc0f59b5
SHA1 b6e462873af6bc62b03d8ba79936b4650afd16a1
SHA512 a526580965ae3862d9ea210c9fd0291954f646f6892dd930658212a578d02e30b988aacced9157ba35c32998c05ac4c92b8e8bd1399f647f1e3d05bf7b706db1
SSDEEP 98304:o2ZCcBaeEYzjVJ2GDqTkbAa/nxJtWTQ1Un:onGEYzjVJ2GDqAbpLWTQ
TLSH
T12916AE027A9A0098D162E63EE59F8F27EB31BC04073065D727D68B962F277D09E37B51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2095856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpOpen WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSetTimeouts WinHttpQueryHeaders WinHttpQueryDataAvailable

kernel32

VirtualQueryEx CheckRemoteDebuggerPresent VirtualFree GetCommandLineW GetStdHandle SetConsoleMode VirtualAlloc Module32Next Module32First GetCurrentThreadId GetConsoleMode GetLastError GetCurrentThread GetSystemInfo GetThreadContext LocalFree GetCurrentProcessId GetConsoleWindow VirtualQuery GetComputerNameA SetUnhandledExceptionFilter SetThreadAffinityMask SetThreadPriority GetTickCount GetConsoleScreenBufferInfo SetConsoleTextAttribute GetProcessId DuplicateHandle OpenProcess GlobalAlloc FreeLibrary Process32Next GetTickCount64 Sleep VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA CreateToolhelp32Snapshot TerminateProcess GetCurrentProcess lstrcmpiA OutputDebugStringW WriteProcessMemory SetEvent IsDebuggerPresent ReadProcessMemory CloseHandle VirtualProtectEx SwitchToThread CreateEventW WaitForSingleObject InterlockedPushEntrySList LoadLibraryExW GlobalFree GlobalLock GetModuleHandleA WideCharToMultiByte GlobalUnlock VirtualProtect GetModuleFileNameA Process32First QueryPerformanceCounter

user32

SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent SetCursor PeekMessageW GetRawInputData DefWindowProcA RegisterRawInputDevices ShowCursor IsWindow keybd_event MapVirtualKeyA SetWindowTextA MessageBoxA GetWindowThreadProcessId DefWindowProcW GetWindow DispatchMessageA GetWindowRect DestroyWindow IsWindowVisible CreateWindowExW GetSystemMetrics UnregisterClassW ClientToScreen RegisterClassExW ShowWindow GetAsyncKeyState SetWindowLongA GetWindowTextA SetWindowDisplayAffinity GetMonitorInfoA GetTopWindow MoveWindow EnumWindows SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA PostQuitMessage FindWindowA GetCapture UpdateWindow SendInput OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo LoadCursorA GetDC GetCursorPos SetCursorPos ReleaseCapture GetClassNameA ReleaseDC IsWindowUnicode SetProcessDPIAware GetClientRect MonitorFromWindow ScreenToClient

gdi32

CreateSolidBrush GetDeviceCaps

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegQueryValueExA GetUserNameA RegOpenKeyExA

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteA

ole32

CoCreateFreeThreadedMarshaler

vmprotectsdk64

VMProtectDecryptStringA VMProtectIsDebuggerPresent VMProtectBeginVirtualizationLockByKey VMProtectFreeString VMProtectBeginUltraLockByKey VMProtectEnd VMProtectIsValidImageCRC VMProtectBeginMutation

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z _Cnd_wait _Cnd_register_at_thread_exit ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z _Cnd_unregister_at_thread_exit ??0task_continuation_context@Concurrency@@AEAA@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ??7ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A _Xtime_get_ticks ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_id _Thrd_join _Cnd_broadcast ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

api-ms-win-mm-time-l1-1-0

timeGetTime timeBeginPeriod

api-ms-win-core-file-l1-1-0

GetFileSizeEx CreateFileW GetFileType ReadFile SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-heap-l1-1-0

HeapFree HeapReAlloc HeapAlloc HeapDestroy HeapSize GetProcessHeap

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive WaitForSingleObjectEx DeleteCriticalSection LeaveCriticalSection EnterCriticalSection AcquireSRWLockShared SleepEx InitializeCriticalSectionEx InitializeCriticalSection ReleaseSRWLockShared

api-ms-win-core-processthreads-l1-1-0

CreateThread

api-ms-win-core-memory-l1-1-0

MapViewOfFile UnmapViewOfFile CreateFileMappingW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleFileNameW

api-ms-win-security-base-l1-1-0

InitializeAcl GetTokenInformation IsValidSid GetLengthSid CopySid AddAccessAllowedAce

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExA

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA

psapi

GetModuleInformation

api-ms-win-security-provider-l1-1-0

SetSecurityInfo

api-ms-win-core-errorhandling-l1-1-0

SetLastError

api-ms-win-core-localization-l1-2-0

FormatMessageA FormatMessageW GetLocaleInfoEx

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA

ws2_32

getpeername getsockname htons recv setsockopt socket WSAIoctl WSAResetEvent __WSAFDIsSet select bind accept htonl listen getaddrinfo freeaddrinfo WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSAWaitForMultipleEvents WSACleanup WSAStartup connect closesocket inet_ntop WSASetLastError gethostname ntohs inet_pton ioctlsocket sendto WSAEventSelect WSAGetLastError recvfrom

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

bcrypt

BCryptGenRandom

api-ms-win-security-cryptoapi-l1-1-0

CryptHashData CryptCreateHash CryptDestroyKey CryptImportKey CryptEncrypt CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptAcquireContextW

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CryptStringToBinaryW CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CertFreeCertificateChain

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW GetEnvironmentVariableA

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

dbghelp

SymFunctionTableAccess64 SymInitialize StackWalk64 SymFromAddr SymGetModuleBase64 SymCleanup

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_exception_destroy strstr strchr __current_exception_context __current_exception wcschr memset memmove memcpy memcmp __C_specific_handler memchr _CxxThrowException __std_terminate strrchr _purecall

api-ms-win-crt-heap-l1-1-0

malloc realloc _set_new_mode calloc free _callnewh

api-ms-win-crt-math-l1-1-0

atan2f asinf ceilf __setusermatherr cosf _fdopen acosf _fdclass powf ldexp pow expf logf round lroundf sqrt floorf sinf log sqrtf fmodf _dsign fminf

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo system _errno terminate _register_thread_local_exe_atexit_callback _configure_narrow_argv _c_exit __p___argv _beginthreadex _initialize_narrow_environment __p___argc _initialize_onexit_table abort _register_onexit_function _crt_atexit _exit _cexit _seh_filter_exe _resetstkoflw _initterm_e _set_app_type _initterm _get_initial_narrow_environment __sys_nerr __sys_errlist exit _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

strpbrk wcsncmp strcmp strspn wcspbrk wcsncpy strcspn _wcsdup toupper isalpha isalnum strncmp strlen iswspace strncpy tolower _stricmp _strdup strcpy_s wcslen

api-ms-win-crt-convert-l1-1-0

strtol wcstombs strtod strtoull strtoll atof strtoul atoi

api-ms-win-crt-stdio-l1-1-0

feof __stdio_common_vsscanf __stdio_common_vsprintf fgets _pclose _popen _wfopen _write fwrite fopen_s ferror _close fread __stdio_common_vfprintf _get_stream_buffer_pointers _fseeki64 fsetpos fputs fseek ungetc setvbuf fgetpos _wopen fclose _fileno fflush _set_fmode fopen _lseeki64 fgetc __acrt_iob_func ftell fputc _read __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

strftime _localtime64_s _localtime64 _gmtime64 _time64

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlink _unlock_file _lock_file _wstat64

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv

oleaut32

GetErrorInfo SysStringLen SetErrorInfo SysFreeString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory