Gridinsoft Logo
File Icon

The smsniff.exe (SmartSniff) File Analysis

Updated 1 year ago
Checked by Malware Check
smsniff.exe

Technical Analysis

File Name smsniff.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
SSDEEP Hash
1536:D8TEXwcKLS2SiDOiXzCqN/lxpF5kQ/YEncXUx8yktm9ZnahOm:ITvcKLS2c0Ndvnb/YAWSY2ns
Scanner Version 1.0.170.174
Database Version 2024-03-29 18:00:43 UTC
⚠

Suspicious File Detected

Detected by 17 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
24%
Detection Rate
80,992
File Size (bytes)
17/72
Engines Detected
2024-03-29
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
a1e45561b188022e69c33479bb8370a7
SHA1
febf8aa857bbc9bf279228b22d6dc89c570b18e2
SHA256
326f3c55a978216a140d20516fc2008353ea92380fde373f9c381d902d4c9fd6
SHA512
6669b3cab1cd059a853e42a0c68f03f7ae68563168d6961ca524efdb090a35791956b117949b4a46edc3c7d4437c473023aec29a1a9fcf621e5c13ecce9c8397
ImpHash
db1efd78b18ae8a8d9f38e6df85b8c40

Security Engines with Detections (17 of 72)

CAT-QuickHeal
Program.Win32CiR Malicious
Cylance
unsafe Malicious
Zillya
Worm.Ngrbot.Win32.7863 Malicious
K7AntiVirus
Unwanted-Program ( 004d38111 ) Malicious
K7GW
Unwanted-Program ( 004d38111 ) Malicious
ESET-NOD32
a variant of Win32/Sniffer.SniffPass.B potentially unsafe Malicious
NANO-Antivirus
Trojan.Win32.Mlw.fbvobm Malicious
Avast
FileRepPup [PUP] Malicious
GData
Win32.Riskware.SmartSniff.A Malicious
Antiy-AVL
HackTool[Sniffer]/Win32.SniffPass Malicious
Microsoft
PUA:Win32/Presenoker Malicious
Malwarebytes
Generic.Malware/Suspicious Malicious
Rising
PUA.Presenoker!8.F608 (CLOUD) Malicious
Yandex
Trojan.GenAsa!8C2DwnqCimU Malicious
Fortinet
Riskware/SniffPass Malicious
AVG
FileRepPup [PUP] Malicious
DeepInstinct
MALICIOUS Malicious
55 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: eed2401757b6e4ed9a51e6ed3f27f46f
Fuzzy: 34e11c89e9f3d9e911756d873905dfc6
dHash: e5a399bcf478ae60
Image Base 0x00400000
Entry Point 0x00437430
Compilation Time 2013-03-03 07:31:46
Checksum 0x000190ce (Actual: 0x000190ce)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Digital Signature SignerInfo.version must be 1, not 0
Imports 10 libraries
KERNEL32, ADVAPI32, COMCTL32, comdlg32, GDI32, msvcrt, ole32, SHELL32, USER32, WS2_32
Exports 0 functions
Resources 45 Resources
Sections 3 Sections

Version Information

▼
CompanyName NirSoft
FileDescription SmartSniff
FileVersion 2.05
InternalName SmartSniff
LegalCopyright Copyright © 2004 - 2013 Nir Sofer
OriginalFilename smsniff.exe
ProductName SmartSniff
ProductVersion 2.05
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
UPX0 0x00001000 155,648 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
UPX1 0x00027000 69,632 bytes 67,072 bytes 7.91 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F70B6630241AB7AEC560941AE3C40A14
.rsrc 0x00038000 8,192 bytes 6,656 bytes 3.79 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D695F4004FB0E47BD5E98FD61D61D59C
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 45 (23,921 bytes)
Resource Type Count Total Size Percentage
BIN 2 4,233 bytes
17.7%
RT_CURSOR 2 616 bytes
2.6%
RT_BITMAP 3 2,008 bytes
8.4%
RT_ICON 5 1,928 bytes
8.1%
RT_MENU 3 3,490 bytes
14.6%
RT_DIALOG 8 6,570 bytes
27.5%
RT_STRING 13 3,502 bytes
14.6%
RT_ACCELERATOR 1 192 bytes
0.8%
RT_GROUP_CURSOR 2 40 bytes
0.2%
RT_GROUP_ICON 4 94 bytes
0.4%
RT_VERSION 1 704 bytes
2.9%
RT_MANIFEST 1 544 bytes
2.3%

Certificate Chain Analysis

▼
Certificate Information
Product SmartSniff
Description SmartSniff
File Version 2.05
Original Name smsniff.exe
Signing Date 07:36 AM 03/03/2013 (4499 days ago)
Verification Status Signed
Signers Nir Sofer; COMODO Code Signing CA 2; UTN-USERFirst-Object; Sectigo (AddTrust)
Counter Signers COMODO Time Stamping Signer; UTN-USERFirst-Object; Sectigo (AddTrust)
Internal Name SmartSniff
Copyright Copyright © 2004 - 2013 Nir Sofer
Certificate Chain Summary
UTN-USERFirst-Object #1 Primary
Validity Period: 2005-06-07 08:09:10 → 2020-05-30 10:48:38
Signature Algorithm: sha1RSA
Serial Number: 42 1A F2 94 09 84 19 1F 52 0A 4B C6 24 26 A7 4B
COMODO Time Stamping Signer #2 Chain
Validity Period: 2010-05-10 00:00:00 → 2015-05-10 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 47 8A 8E FB 59 E1 D8 3F 0C E1 42 D2 A2 87 07 BE
COMODO Code Signing CA 2 #3 Chain
Validity Period: 2011-08-24 00:00:00 → 2020-05-30 10:48:38
Signature Algorithm: sha1RSA
Serial Number: 10 70 9D 4F F5 54 08 D7 30 60 01 D8 EA 91 75 BB
Nir Sofer #4 Chain
Validity Period: 2012-09-17 00:00:00 → 2014-09-17 23:59:59
Signature Algorithm: sha1RSA
Serial Number: A1 A3 E7 28 0E 0A 2D F1 2F 84 30 96 49 82 05 19

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

SignerInfo.version must be 1, not 0

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
17 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware