��z�^����\�}0��8!E��� o߇U� ��,g,t�2�lV�TJ pY���[��17:x�͐x�&����/ HY�����y�������3������u�^I�W�Q�Wg^&��l�D��Z��V��Aģ�a'��R����(�Y@)+n���:�p2l�E�+X.�aŐ��V���)����م2>�G{n�[�C��P�(�������;*T&g?Դ��)�ɳ�5����!�fo���'ٰ�&��Ooc���Ē|0����>�u�GU���Z�y|]#㽩K��"-Q��n�� �}%L--��2EBcD_�$!3�N�Ȍp~ݱ�/~�}�@�U��Du�1���L�Ϳ�4�#��!@�3u�Q��"]���O�2YJ�:����m��kS��O8� w�7w������J��%dЦP0����AF$��.�zK'Oe��7;���dV�-���4D�q�@Z�1ɲ~j�υ�&Hl���L�(r�I����聑(>+q��y��A#�Qdܗ �D;xX��cI�C�ě"]?,}���e�Ğ6��=�����eA��Jk�d�D��'���h p��@:�䣴K�I1��w��><;�,�˫:������H|Âs�9/�m�ҽ��5��6$���W��#Aa��R tSx�m����L�zI��F��&�sR���8rd��]������t"PȜ�K*/o��NH�bA��Lk>;��Yp�&{���2QU�Ы2T.�T��U��`57��n��x'ϸt�t�zI��R�M4adb,=�*���r�Y�\ � =-�;�d�U�#���(��>J8�6rO*���0X��!���n�ا(K��[�t�wџ�d\�!Q����_��X Q'���*��Z��s2���Z{�M����&� D�`�&�Z���\T�`��5a �I ;L��ij�fb��êD�� �P۰3�.ڌX~��i�o�7fކ(�Ϸ���1��I��q�t��r��7e5*O��{�3�H�YM�����Q�?uC�@��Ci2�ɳ��Y)`���;G�=��!���{�B{����%Js=�����j�) !��(I�Q�����y*v�a��m��o�bS}*s��;�e��X���Y���lTA#��m ����Qc�v���hw��iX����T�I�϶th������x]1�ݵ�w��H#h����x�e�t�qX�����4��$nK����}��I�4ur��D8���2�QA?�hQ�r R!�E7&U� �KZ��x+�`vd�B1��,��|2UX�js�ߖ�łW>��b�'M����^n\b*`��=��o�1�ڼ�i��4ܦ�Oy�\�P攵��m*A<Y!\b�4F�m��ߺ��G��/wQѨVC��!�_]��2S�k�s�(�/2�Rq�^L+/���P���� R�X����\`X�$N� n($�IS1�>�k�i�\9&�ݩ����(���ia{(�A@`<?_#�k��������V�� H��l��I�pj�<����J�G��f��%?em���{~�T�>��۲��^�::G<}����� �(*ɧ��$/Xk"���";���j�L�nD[9[����;;��.���5���d*u�Ơ�ik���X��7����g��\�ꚣ�a����@�˅��9ؖ��� �+���T(5/e�w�p��9M#�?k ���1��fG=�/�,q��O�=�z4h1�v����� ��s�Ov��<��Ǡ+ǃwJ���̫/-.��:��@����,ީ��*T�����A��� ������f����33:﨨Z_@b�� 4�u���)N�r2q�<�i3Jv�����U!�n�y$�<���/�R��n���ܡ�cYL�.�$o�c>�ch%�b6���|�M�U�%����G8�7`G�u�{�Z���6���:�7B}�^L�wa�W�n�teZ�>">ʝ*��F|7�0��y[��{�����ŧ ۄ\��]!$�3��t[͜���&{Ev<��g;�8���.��k�G�\�JP��7�7��s������$���3�u�A?������i`x��I�[�3���9��Cr�g�I�96���bL�d~�\�Ќ�����x���L�ܔ��4���9�A_�X.��5A�|j��>XR�2���!Ż�����7��;� .]�t�f�w]��_��W��+d��+;ynF�*^��CZ����g�g�+�H-G�����x�CՇS4Qh�-�d,����&!���� T���w��FJ.�b:\e���(W�e�pF�ӱ+b���,>����z�^@�PRdes�:�. ���\��Js�]����`�����@.����Ѡ�h����9N�yx����&y�����ɧ��9�9+p;;�� �ai����Q�i�l���~ z$����Nm�I˄��D�*@�����c����ը�,';���\z.�C��s���k�Hp�t:Q \�g�$b�t����Ĕ��|a��5d�&+>h&�5%��ԑ��[=m_*�Ø�Z�)3ڞAr���Uw=����.�)¨_e:�:���&9��Z��|������@8��S�5�?1���g��������n��w����coX�3_��ו��t��ΗFϐU�Q"�T%8p7��0|��� ���,���j]YҡC��(���H |�߲�MB}��QY����E���u�nx-_�3w��Bwh[�s) �A��n��K\��H����_�=��@��UD��`��u�~$DZ�[�88'M�X��m �r�;~�7�����S @s�̉?�-��"a��O�IPB��}u�� [���q�Gww�6�0��>��a;U�����K�(^���i(��!|����v5��p4� �+���D%��m��#�*��f���k�0�Md��~�7 �J�=�e]���Rz�<����^ ���9�8�'�99�Ļ��e)5���W:S��Pgxn�"�#E�a�4L���� �:�P�3�Lx~�n�e2�X��"1�C��K����u֙�b�c��{�;����s�H�Y���(�����ʭ��e4ٌ�`�?�A+~��W�O�tl!�/����L�C�
Static task
static1
Behavioral task
behavioral1
Sample
crack_SLENDER.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
crack_SLENDER.exe
Resource
win10v2004-20231215-en
General
-
Target
crack_SLENDER.exe
-
Size
4.3MB
-
MD5
facbd28f73d0083d2a66ca47369002fc
-
SHA1
fafdb9bc0214f123df0c3548bad5cd2f09326fe1
-
SHA256
aaeb622acccdd6fa3ebf69a517b24008ee6bf7479bb6f4927c17abeeac30144c
-
SHA512
3c7e4f78d900a4e80d294132b2010a497f0dbb3ac6acb6a7214be63e12c0824bb38a03d1367b6c22b8b850d463f82557f0f1360ba284261d63935f19e36c2270
-
SSDEEP
98304:Qul0/QxOOLRUHKjqWnxOa1jf+jRLmvO+olnTDQnOtkqo+jrSf8:/2/IOli/nzjf+tLtrlTDqOt3mf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource crack_SLENDER.exe
Files
-
crack_SLENDER.exe.exe windows:6 windows x64 arch:x64
262b9605deafdb994970c30f8ab867f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcrt
wcstoul
ntdll
RtlLookupFunctionEntry
advapi32
QueryAllTracesW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
kernel32
GetFileType
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextW
CharUpperBuffW
ole32
CoInitializeEx
comctl32
ord412
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yctjje Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.smezy Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ffzex Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ichnc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jmmsdp Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ