snip[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
snip.zip
Size 1.8MB
Sample261113-vb8jpady7p
SHA256 92d256dc79f78105ede3a4c7c3317d30cdc12dd234e36fae532d52eeabaa66f0
MD5 6316a0eb3554260c13a241ce9212f265
SHA1 d5ff21b4d6c3b9b293d4a5dbfa95eec7cee5221b
SHA512 da8ae7ceb929bf825f3f35e6b104bf76a537755d9bc3b25687576a275d6a42d7e05b173048f39b83c7f704aff8a22c5a5795bc3780ff68e1ed95a390fb4aadb2
SSDEEP 49152:zFFYOWT3VBQm3woYx7fae1gRnGTT4HEHQ2Q:zcV4a+oGTLw2Q
TLSH
T11B9533DD67CAB0C9D9F2B4221791876EA72CA5DEE6895C1ED4160CFC6001DE08898FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/snip.exe

File Explorer

snip.zip

.zip 1.8MB
snip.exe

.exe 5.0MB

snip.zip

SHA256 92d256dc79f78105ede3a4c7c3317d30cdc12dd234e36fae532d52eeabaa66f0
MD5 6316a0eb3554260c13a241ce9212f265
SHA1 d5ff21b4d6c3b9b293d4a5dbfa95eec7cee5221b
SHA512 da8ae7ceb929bf825f3f35e6b104bf76a537755d9bc3b25687576a275d6a42d7e05b173048f39b83c7f704aff8a22c5a5795bc3780ff68e1ed95a390fb4aadb2
SSDEEP 49152:zFFYOWT3VBQm3woYx7fae1gRnGTT4HEHQ2Q:zcV4a+oGTLw2Q
TLSH
T11B9533DD67CAB0C9D9F2B4221791876EA72CA5DEE6895C1ED4160CFC6001DE08898FDF
MD5 SHA1 SHA512 SSDEEP TLSH

snip.exe

IMPHASH 2eb574ead884801fab4586a457bba528
SHA256 5bd2449d67618cd909e74ed98b6318317d56ab2736374b655ad2216fcac27de1
MD5 41254b42eff17601977f2200cd940a96
SHA1 ac81265ce2357cc50aa6cd3a1a2e2ca10b50bd50
SHA512 b7c67e3ef3ce888a0cf0a86545dca172ed1873c67ba836e644deccc9b8e5b350769d05645db4c77f1220edebc8bac7c988595a13233ef5bae0174a04498e89b0
SSDEEP 49152:7ca0YVi8HH5ibiQZOOpVVNcAPr+l4Vw81c0ivyD60civkrcXPQ42CnEa1wI223Q+:9TVNuDzVw8/D2Zp36+I2nwLBB7
TLSH
T17B362A16F6A654ACC496C4B4D3664673AA3178CE0B347AFF46C482343F7DBE05E28B19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3846004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

snip.pdb

bcryptprimitives

ProcessPrng

kernel32

GetProcessHeap GetLastError HeapFree CloseHandle FormatMessageW CreateThread GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar HeapAlloc QueryPerformanceFrequency IsProcessorFeaturePresent GetModuleHandleA GetFullPathNameW GetConsoleMode CreateFileW SwitchToThread GetSystemInfo GetEnvironmentVariableW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject SetFileInformationByHandle SetFilePointerEx ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx WideCharToMultiByte GetCurrentProcess lstrlenW HeapReAlloc GetProcAddress LoadLibraryA SetWaitableTimer CreateWaitableTimerExW GetCurrentThreadId GetModuleHandleW QueryPerformanceCounter RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter

gdi32

CreateDIBSection DeleteObject GetDIBits SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteDC GetDeviceCaps BitBlt CreateBitmap CreateRectRgn SetBitmapBits

user32

LoadCursorW GetCursorPos SetCursor ValidateRect GetForegroundWindow MonitorFromWindow SetCursorPos IsWindowVisible DefWindowProcW ScreenToClient GetWindowRect SetWindowLongPtrW GetWindowLongPtrW RegisterClassExW SetWindowTextW GetMenu SetWindowPos CreateWindowExW AdjustWindowRectEx GetWindowLongW DestroyCursor CreateIconIndirect DestroyIcon SetProcessDPIAware GetMonitorInfoW GetDesktopWindow GetDC ReleaseDC DispatchMessageW TranslateMessage GetWindowTextW RedrawWindow GetSystemMetrics SetForegroundWindow TrackPopupMenu GetClientRect PostMessageW SendMessageW DestroyWindow ShowWindow GetWindowTextLengthW EnumDisplaySettingsExW SetMenuDefaultItem RegisterTouchWindow SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor GetActiveWindow ClientToScreen GetKeyboardLayout GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetRawInputData CloseTouchInputHandle GetTouchInputInfo SystemParametersInfoW TrackMouseEvent CreateIcon SetWindowDisplayAffinity ToUnicode SetWindowPlacement ToUnicodeEx ChangeDisplaySettingsExW SendInput IsIconic PeekMessageW MsgWaitForMultipleObjectsEx MonitorFromRect FlashWindowEx MapVirtualKeyW RegisterWindowMessageA RegisterRawInputDevices EnumDisplayMonitors MonitorFromPoint SystemParametersInfoA ReleaseCapture SetCapture GetWindowPlacement IsProcessDPIAware InvalidateRgn

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

DragQueryFileW SHCreateItemFromParsingName DragFinish

ole32

OleInitialize CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree RevokeDragDrop RegisterDragDrop

imm32

ImmGetCompositionStringW ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmAssociateContextEx

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__current_exception_context memset __current_exception __CxxFrameHandler3 memcpy memmove _CxxThrowException memcmp __C_specific_handler

api-ms-win-crt-math-l1-1-0

fma pow fmaf floorf __setusermatherr log2f trunc round roundf exp log2 ceil floor truncf powf

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argc _c_exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate __p___argv _seh_filter_exe _cexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode