Snowhush-Setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Snowhush-Setup.exe
Size 1.1MB
Sample261030-mdjpcabt5w
SHA256 4003a45255d5cf1af4a403b0a88faf1e4b90719cd992d166e36d95c4c2f44bfe
MD5 37047a57a9a59d9597a47965f7ec1d0a
SHA1 5bf44a4da69a455433516cf73ac6dad7871211a4
SHA512 7b6928e14eb0eafce39fc97be89fbf82b557a077d24fab2cc4bea492ea8b2868ecdc83a1916d6278434538c9f6feabc0b2462f30f1adff7a63fd88f3221a502d
SSDEEP 12288:dv/TnYuDjviVEfka5XcQfFbCk14HXB2S7fcoL+T+0+Td+TVb0h0+T:dvRD/HKQdbCkqHpLo+0odoxI0o
TLSH
T1A835AD12B7A291FCD05BC076C3165A73AA72788A0B327AFB139446353F65BE51F39B04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Snowhush-Setup.exe

File Explorer

Snowhush-Setup.exe

.exe 1.1MB

Snowhush-Setup.exe

IMPHASH 538d9048c42cfabf1c0cd707534fa44b
SHA256 4003a45255d5cf1af4a403b0a88faf1e4b90719cd992d166e36d95c4c2f44bfe
MD5 37047a57a9a59d9597a47965f7ec1d0a
SHA1 5bf44a4da69a455433516cf73ac6dad7871211a4
SHA512 7b6928e14eb0eafce39fc97be89fbf82b557a077d24fab2cc4bea492ea8b2868ecdc83a1916d6278434538c9f6feabc0b2462f30f1adff7a63fd88f3221a502d
SSDEEP 12288:dv/TnYuDjviVEfka5XcQfFbCk14HXB2S7fcoL+T+0+Td+TVb0h0+T:dvRD/HKQdbCkqHpLo+0odoxI0o
TLSH
T1A835AD12B7A291FCD05BC076C3165A73AA72788A0B327AFB139446353F65BE51F39B04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

171976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Snowhush_Setup.pdb

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringW CreateDirectoryW CreateFileW CreateMutexA CreateWaitableTimerExW DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MoveFileExW MultiByteToWideChar OpenProcess QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableA SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile lstrlenW

ole32

CoCreateInstance CoInitializeEx

combase

CoTaskMemFree

gdi32

CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject SelectObject

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW FindWindowW GetCursorPos GetDC GetMessageW GetMonitorInfoW GetWindowRect GetWindowThreadProcessId LoadCursorW LoadImageW MonitorFromPoint PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC SendMessageTimeoutW SetCapture SetForegroundWindow ShowWindow TranslateMessage UpdateLayeredWindow

d2d1

D2D1CreateFactory

dwrite

DWriteCreateFactory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

oleaut32

GetErrorInfo

advapi32

RegGetValueW RegSetKeyValueW

ntdll

NtWriteFile RtlNtStatusToDosError

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath ShellExecuteW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

853KB

Virtual Size

853KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

249B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Snowhush-Setup.exe

kernel32

ole32

combase

gdi32

user32

d2d1

dwrite

api-ms-win-shcore-scaling-l1-1-1

oleaut32

advapi32

ntdll

shlwapi

shell32

api-ms-win-core-synch-l1-2-0

generic