AgPmDestroySourceConnection
AgPmEventEnabled
AgPmEventLoggingEnabled
AgPmSubmitEvent
NxCreateCoreSDK
Static task
static1
1 signatures
General
-
Target
Slender - The Eight Pages.exe
-
Size
8.7MB
-
MD5
feb7f310e42ec1a645dd2f9420ed9f66
-
SHA1
015230a73ac738b03e5060725e7530b77941569a
-
SHA256
ce78bd4d359a3883eb9e3a0c75b8af2d48369269e92309f7a5bb34eb77040a7c
-
SHA512
dc7d9394cab60d90715cfe375cd8dda54e70740e0796904befea31358fe49eb401139bf1c0077d919e1aafe2c38a3d55f03ba9031eb4fcf5c596a7943694e6ed
-
SSDEEP
196608:8uXu7R6DZZJ9MXuLFEO2wM57PqUFaIFuVdMi1RM8K+S:24D7HMeLFEO2wM57KuiLM7
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Slender - The Eight Pages.exe
Files
-
Slender - The Eight Pages.exe.exe windows:5 windows x86 arch:x86
cf55049bcdd0af426af9913d8367607d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThread
GetProcessAffinityMask
GetCurrentProcessId
SetUnhandledExceptionFilter
OutputDebugStringA
SetLastError
ReadProcessMemory
GetEnvironmentVariableA
GetFileAttributesA
GetModuleFileNameA
GetCurrentDirectoryA
ResumeThread
GetThreadContext
SuspendThread
IsBadReadPtr
ResetEvent
GetTickCount
CopyFileW
MoveFileExW
FileTimeToDosDateTime
FileTimeToLocalFileTime
lstrlenA
GetFileTime
VirtualQuery
GlobalMemoryStatus
GetSystemTimeAsFileTime
CreateProcessW
IsDebuggerPresent
SetErrorMode
WritePrivateProfileStringW
HeapValidate
TerminateThread
WaitForMultipleObjects
GlobalUnlock
FindFirstFileW
FindNextFileW
RemoveDirectoryW
DeleteFileW
FindClose
WriteFile
GetFileAttributesW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetProcessHeap
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFileAttributesW
GetConsoleCP
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapSize
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
GetTimeZoneInformation
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetDriveTypeA
PeekNamedPipe
GetTempPathW
FileTimeToSystemTime
WriteConsoleW
GetStartupInfoA
SetThreadAffinityMask
DuplicateHandle
ExitThread
TerminateProcess
ExitProcess
UnhandledExceptionFilter
SetConsoleCtrlHandler
RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
InterlockedDecrement
InterlockedIncrement
CreateSemaphoreW
CreateMutexW
GetModuleHandleW
SignalObjectAndWait
GetThreadLocale
FlushConsoleInputBuffer
FindFirstFileA
GetStdHandle
GetFileType
GetVersion
GetSystemDirectoryA
OpenEventA
VirtualAlloc
VirtualFree
UnmapViewOfFile
CreateFileA
CreateFileMappingA
MapViewOfFile
GetFileSize
GetLastError
ReadFile
CreateFileW
SetEndOfFile
SetFilePointer
GetCurrentThreadId
SleepEx
CreateThread
SetThreadPriority
RaiseException
ReleaseMutex
WaitForSingleObject
CreateMutexA
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEvent
CreateEventA
QueryPerformanceFrequency
QueryPerformanceCounter
FormatMessageA
LocalFree
GetFullPathNameW
ReleaseSemaphore
WaitForSingleObjectEx
Sleep
CloseHandle
CreateSemaphoreA
LoadLibraryW
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
CreateDirectoryW
MultiByteToWideChar
TlsSetValue
lstrcmpiA
GetFullPathNameA
InterlockedExchange
InterlockedCompareExchange
GetUserDefaultLangID
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
GetModuleHandleA
GetCurrentProcess
ExpandEnvironmentStringsA
CreateEventW
GetOverlappedResult
CancelIo
GetCommandLineA
GetComputerNameW
TlsGetValue
TlsFree
TlsAlloc
lstrlenW
GetCommandLineW
lstrcpynW
lstrcpyA
lstrcpynA
GetModuleFileNameW
GlobalAlloc
GetFileInformationByHandle
GlobalLock
FlushFileBuffers
InterlockedExchangeAdd
HeapWalk
user32
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
IsClipboardFormatAvailable
SetCapture
GetProcessWindowStation
GetUserObjectInformationW
ReleaseCapture
RegisterDeviceNotificationW
UnregisterDeviceNotification
SystemParametersInfoW
ClientToScreen
DefWindowProcW
DestroyWindow
ReleaseDC
GetDC
CreateWindowExW
MessageBoxW
GetAsyncKeyState
GetKeyState
wsprintfA
RegisterRawInputDevices
GetRawInputData
GetRawInputDeviceList
GetRawInputDeviceInfoW
SendMessageTimeoutA
EnumWindows
SendMessageA
SetForegroundWindow
ShowWindow
IsIconic
RegisterWindowMessageA
GetUserObjectInformationA
GetThreadDesktop
GetParent
GetWindowRect
GetWindowLongA
SetWindowPos
GetClientRect
CreateDialogParamA
IsWindowVisible
GetCursorPos
WindowFromPoint
ScreenToClient
wvsprintfA
MonitorFromWindow
EnumDisplayDevicesA
GetCaretBlinkTime
PeekMessageA
GetMessageA
DispatchMessageA
ValidateRect
LoadImageA
DialogBoxParamA
IsDlgButtonChecked
CheckDlgButton
CreateDialogParamW
EnableWindow
PeekMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
SetWindowTextW
RegisterClassW
PostQuitMessage
SetWindowLongW
GetWindowLongW
SetFocus
SetCursorPos
ClipCursor
ShowCursor
GetFocus
LoadCursorA
RegisterClassExW
DialogBoxParamW
EndDialog
LoadIconA
SendDlgItemMessageW
SetDlgItemTextA
SetDlgItemTextW
MessageBoxA
CopyRect
OffsetRect
GetAncestor
UnregisterClassW
GetDesktopWindow
EnumDisplaySettingsA
AdjustWindowRectEx
GetSystemMetrics
ChangeDisplaySettingsA
GetDlgItem
SetWindowLongA
gdi32
GetDeviceCaps
ChoosePixelFormat
SetPixelFormat
GetObjectW
GetGlyphOutlineW
AddFontMemResourceEx
CreateCompatibleDC
GetFontUnicodeRanges
GetObjectA
SetTextAlign
SetTextColor
CreateFontIndirectW
SelectObject
GetTextFaceW
EnumFontFamiliesExW
DeleteDC
DeleteObject
RemoveFontMemResourceEx
SetBkMode
GetBitmapBits
BitBlt
CreateCompatibleBitmap
CreateDCA
SwapBuffers
advapi32
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptImportKey
CryptVerifySignatureA
CryptDestroyKey
RegDeleteValueA
GetUserNameA
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
shell32
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
ole32
CoUninitialize
CoInitialize
CoCreateGuid
StringFromGUID2
CoSetProxyBlanket
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
opengl32
glStencilMask
glStencilOp
glStencilFunc
glIsEnabled
glClear
glClearStencil
glClearDepth
glClearColor
glFrontFace
glLoadMatrixf
glMatrixMode
glMultMatrixf
glGetFloatv
glColorMaterial
glLightModeli
glMaterialf
glMaterialfv
glColor4fv
glViewport
glScissor
glTexEnvfv
glBindTexture
glTexGenfv
glTexGeni
glLightfv
glLightf
glLightModelfv
glFogfv
glFogf
glFogi
glDeleteTextures
glFinish
glDepthFunc
glNormal3f
glColor4f
glTexCoord3f
glBegin
glEnd
glReadPixels
glLoadIdentity
glLightModelf
glHint
glTexParameteri
wglDeleteContext
glGenTextures
glTexImage2D
glDrawArrays
glReadBuffer
glDrawBuffer
glCopyTexSubImage2D
glPixelStorei
glTexSubImage2D
glIsTexture
glDrawElements
glGetString
glDepthMask
glCullFace
glPolygonOffset
glColorMask
glDisable
glBlendFunc
glAlphaFunc
glNormalPointer
wglCreateContext
wglMakeCurrent
glGetIntegerv
glEnable
wglGetCurrentContext
wglGetCurrentDC
wglShareLists
wglGetProcAddress
glGetError
glTexEnvi
glTexEnvf
glDisableClientState
glEnableClientState
glColorPointer
glVertexPointer
glVertex3f
glTexCoordPointer
winmm
waveInReset
waveInClose
waveInOpen
waveInStart
waveInGetDevCapsW
waveInGetDevCapsA
waveInUnprepareHeader
waveInPrepareHeader
waveInAddBuffer
waveOutPrepareHeader
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutOpen
waveOutClose
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutGetDevCapsA
waveInGetNumDevs
timeGetTime
timeEndPeriod
timeBeginPeriod
waveOutGetPosition
ws2_32
htonl
inet_ntoa
WSAStartup
getsockname
gethostname
WSACleanup
freeaddrinfo
closesocket
getaddrinfo
connect
htons
WSAGetLastError
socket
inet_addr
shlwapi
PathIsDirectoryW
PathFileExistsW
SHDeleteKeyA
oleaut32
SysStringLen
SysAllocString
SysFreeString
VariantInit
VariantChangeType
VariantClear
imm32
ImmGetContext
ImmAssociateContext
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetConversionStatus
ImmSetOpenStatus
ImmReleaseContext
ImmSetCompositionStringW
dnsapi
DnsFree
DnsQuery_A
iphlpapi
GetIpAddrTable
hid
HidP_GetData
HidD_GetPreparsedData
HidD_GetProductString
HidP_GetCaps
HidP_GetButtonCaps
HidP_GetValueCaps
HidP_MaxDataListLength
HidD_FreePreparsedData
HidD_GetHidGuid
wsock32
inet_ntoa
gethostbyaddr
gethostbyname
recv
send
select
WSACancelAsyncRequest
WSAAsyncGetHostByName
listen
bind
accept
ntohs
getsockopt
getpeername
setsockopt
recvfrom
WSASetLastError
__WSAFDIsSet
shutdown
sendto
msacm32
acmStreamSize
acmStreamPrepareHeader
acmStreamConvert
acmStreamUnprepareHeader
acmFormatSuggest
acmStreamOpen
Exports
Exports
Sections
.text Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 154KB - Virtual size: 698KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 348KB - Virtual size: 347KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ