slacker[.]exe | Triage

General

Target

slacker.exe
Size

52KB
MD5

53245db399ae003e82fdecb0871e66d3
SHA1

c9477f70fbe81308bbb3fead321954be1e12ace7
SHA256

512ba3cb0883df793e9724cf0163ce962ad561f278df20c31c1202b05ed43919
SHA512

afb325faf2cbd9b2629e13b91f536a0d52d93f4fe063c5ccf604d4458ee476645eb7d152b2bc3ed4d8c22b0b6b78cd843e06f9c55400c4bfd6f0d2f20e27ea74
SSDEEP

768:aMJ6I5kcKMyBHW/5yarIQ9aijwa7Hy4U+F0JgfCXlRXAQTrD:scKMyBqcaa8wa7M+y5D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
slacker.exe

Files

slacker.exe
.exe windows:4 windows x86 arch:x86

bbe603381a8ab5935da88e7275768c29

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Code\Slacker\Release\Slacker.pdb

Imports

kernel32

GetFileSize
SetEndOfFile
FlushFileBuffers
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileAttributesExA
FindNextFileA
FindClose
FindFirstFileA
GetCurrentProcess
GetLastError
DeviceIoControl
SetFileValidData
CloseHandle
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
GetSystemTimeAsFileTime
GetModuleHandleA
GetCommandLineA
GetVersionExA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetProcAddress
TerminateProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
HeapSize
SetStdHandle
GetLocaleInfoA
VirtualProtect
GetSystemInfo
LCMapStringA
LCMapStringW

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bbe603381a8ab5935da88e7275768c29

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 7KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 7KB