CodeSniper (4)[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
CodeSniper (4).zip
Size 70KB
Sample261027-vd1a4aea95
SHA256 14f73a83b95625be62f6154c762fed3210fe521ed6d8954f5bd9300d4e45daa2
MD5 79ffeedee4800a578c1d74c083d83942
SHA1 47a38070d1f98e29a69b4174a180ad9698c6d70d
SHA512 ba493a47eaea9d4f00d58e032653b7b8e8ffab9d26195cd0cc6160e386ae5e021bf3b96f3b8722608d6d06b4a70bf3fe2498abea7c2f04090c6f26847187d89d
SSDEEP 1536:umR9ThA6nohv+8MAX4FDLi6rMwbr0b5ZMUt9xjv5ldaOCe:umXTzO/4F/i1o0b5Z7t9tf1P
TLSH
T16A6302F2053CE45621CDACCBADBEA23991D693AB9F2C1AD459024A380A7E7564F503F4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CodeSniper.exe

File Explorer

CodeSniper (4).zip

.zip 70KB
CodeSniper.exe

.exe 255KB

CodeSniper (4).zip

SHA256 14f73a83b95625be62f6154c762fed3210fe521ed6d8954f5bd9300d4e45daa2
MD5 79ffeedee4800a578c1d74c083d83942
SHA1 47a38070d1f98e29a69b4174a180ad9698c6d70d
SHA512 ba493a47eaea9d4f00d58e032653b7b8e8ffab9d26195cd0cc6160e386ae5e021bf3b96f3b8722608d6d06b4a70bf3fe2498abea7c2f04090c6f26847187d89d
SSDEEP 1536:umR9ThA6nohv+8MAX4FDLi6rMwbr0b5ZMUt9xjv5ldaOCe:umXTzO/4F/i1o0b5Z7t9tf1P
TLSH
T16A6302F2053CE45621CDACCBADBEA23991D693AB9F2C1AD459024A380A7E7564F503F4
MD5 SHA1 SHA512 SSDEEP TLSH

CodeSniper.exe

IMPHASH 700e95e97c784a2eafdbaa6a6de726c7
SHA256 1205e87e54bc60a7a6ab3ea03a6dba8a7d3d30e4b8ce742410d7765e1b2c94c6
MD5 016833e2cc9a79b4414e49e321038adf
SHA1 c3fd6e9a2cf63593e2096621d34fb6c1a9804a9b
SHA512 b2835d4a37d55e8bfc1d07313f0fe70a29eb453cd51d2a0d010370cdb083cc5cbaa2c0d06886e84a7d4743e076c0c7d10766af5968340dd6b24f6e3b710f702e
SSDEEP 3072:5iHJxdvZtJQoTXxGtBqLwpl73CZ3mOYcHcpfpffpffNafpfNfNpfffpNIfNpffNU:5ipthsqK73CCmGWctT
TLSH
T18D447607D939CAD0ED76D0385243760EF8B0B86567B4A3C397824A479BD1BF6663E390
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage EmptyClipboard DispatchMessageA FillRect GetCursorPos GetWindowRect GetWindowTextLengthW GetWindowTextW SetWindowTextW EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture SendInput GetMessageA SetClipboardData CloseClipboard OpenClipboard SetWindowPos MoveWindow SetLayeredWindowAttributes ShowWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcA SendMessageW RegisterHotKey

gdi32

Rectangle CreateCompatibleBitmap CreateCompatibleDC CreatePen CreateSolidBrush DeleteDC DeleteObject GetDIBits GetStockObject SelectObject BitBlt

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l2-1-0

GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

msvcp140

?is@?$ctype@_W@std@@QEBA_NF_W@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@_W@std@@2V0locale@2@A ?id@?$collate@_W@std@@2V0locale@2@A __crtLCMapStringW _Cnd_do_broadcast_at_thread_exit ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Thrd_detach ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ _Wcsxfrm _Wcscoll ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z

kernel32

GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter

vcruntime140

__current_exception __current_exception_context _purecall __RTtypeid memcmp memcpy memmove memset strchr __std_exception_copy __std_exception_destroy __std_type_info_compare _CxxThrowException __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table terminate _beginthreadex abort _errno _register_thread_local_exe_atexit_callback _c_exit _cexit exit _seh_filter_exe _initterm_e _initterm _get_narrow_winmain_command_line _invalid_parameter_noinfo _initialize_narrow_environment _configure_narrow_argv _exit _set_app_type

api-ms-win-crt-string-l1-1-0

strlen wcslen iswspace

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc free _set_new_mode

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary LoadLibraryExW GetProcAddress

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoInitializeEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapFree HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList

api-ms-win-core-synch-l1-1-0

SetEvent WaitForSingleObject CreateEventW

api-ms-win-core-handle-l1-1-0

CloseHandle